This vulnerability arises from insecure deserialization of a crafted serialized Java object sent to the Cisco ISE web management interface. An attacker with at least low-privileged administrative access can exploit this flaw to execute arbitrary code on the device, escalate privileges to root, and potentially cause denial of service by making the affected node unavailable. The vulnerability affects specific versions of Cisco ISE software, namely 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0.

Successful exploitation allows remote authenticated attackers to execute arbitrary code with root privileges on the affected device, leading to full system compromise. In single-node deployments, it can cause denial of service, preventing unauthenticated endpoints from accessing the network until the node is restored. The CVSS v3.1 base score is 9.9, indicating critical severity with high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity involving serialized Java objects. Avoid using low-privileged administrative credentials on untrusted networks.