This vulnerability in Cisco ISE arises from improper neutralization of special elements in user-supplied input, enabling command injection. An attacker with Read Only Admin privileges can send specially crafted HTTP requests to execute arbitrary OS commands. The attack can escalate privileges to root and cause denial of service in single-node deployments by disrupting the ISE node's availability. Affected versions include multiple releases from 3.1.0 through 3.4 Patch 3. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Read Only Admin credentials can execute arbitrary commands on the underlying OS, potentially escalating privileges to root. In single-node ISE deployments, exploitation can cause denial of service, preventing network access for unauthenticated endpoints until the node is restored. This poses a critical risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Read Only Admin access to trusted personnel only and monitor for suspicious activity involving HTTP requests to the ISE device. Avoid single-node deployments where possible to reduce impact of potential denial of service.