This vulnerability arises from insufficient validation of user-supplied input in the SXP REST API of Cisco ISE. An attacker with valid administrative credentials, the SXP service enabled, and at least one SXP connection configured can exploit this flaw by sending crafted input to the affected device. Successful exploitation can lead to SQL injection attacks that allow viewing or modification of the device's underlying database. In single-node deployments, this may also cause a denial of service condition by making the node unavailable, disrupting network access for unauthenticated endpoints.

The vulnerability enables an attacker with high privileges to perform SQL injection, potentially compromising confidentiality, integrity, and availability of the affected device's database. This includes unauthorized data viewing and modification. Additionally, in single-node deployments, exploitation can cause denial of service, disrupting network access for endpoints that have not yet authenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that only trusted administrators have access to the SXP REST API, disable the SXP service if not required, and monitor for unusual administrative activity. Follow Cisco's official advisories for updates on patches or workarounds.