This vulnerability exists in the REST API of Cisco ISE and ISE-PIC due to improper neutralization of special elements in user-supplied input. An attacker with valid administrative credentials can send crafted commands to the web-based management interface, leading to OS command injection. Successful exploitation allows arbitrary code execution with root privileges and may cause denial of service in single-node deployments by making the affected node unavailable.

An attacker with administrative credentials can execute arbitrary OS commands with root privileges on the affected device, potentially taking full control. In single-node deployments, exploitation can cause the node to become unavailable, resulting in denial of service and preventing unauthenticated endpoints from accessing the network. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Because exploitation requires valid administrative credentials, enforcing strong authentication and access controls is critical.