This vulnerability in Cisco ISE and ISE-PIC arises from improper authorization checks when accessing certain resources. An unauthenticated remote attacker can exploit this by sending crafted traffic, potentially gaining access to sensitive information such as hashed credentials. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. The affected versions explicitly identified are 3.4.0 and 3.5.0. No vendor advisory or patch information is currently available.

Successful exploitation allows an unauthenticated remote attacker to access sensitive information on the affected Cisco ISE device, including hashed credentials. This could facilitate further attacks leveraging the disclosed credentials. There is no indication of impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to Cisco ISE management interfaces and monitor for suspicious traffic patterns targeting these devices.