Cisco Identity Services Engine (ISE) versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0 contain insufficiently protected credentials vulnerabilities categorized under CWE-522. These weaknesses could allow attackers with low privileges to compromise credential confidentiality, integrity, and availability, leading to a critical security impact. The vulnerabilities were discovered internally by Cisco's engineering teams during a comprehensive security review, resulting in a software hardening release to address these issues. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

The vulnerability allows attackers with low privileges to access or compromise credentials that are insufficiently protected, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. Given the critical CVSS score of 9.9, exploitation could severely affect the security posture of affected Cisco ISE deployments. No known exploits are currently reported in the wild.

Cisco has released a software hardening update addressing these vulnerabilities as part of their internal security review. Users of Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0 should apply the official Cisco updates or patches once available. Patch status is not yet confirmed from the provided data; therefore, check Cisco's official advisory for current remediation guidance. No additional mitigation steps are specified in the available information.