This vulnerability arises from insufficient validation of certain parameters in Cisco ISE APIs that are concatenated directly into SQL queries. An attacker with valid administrative credentials can send crafted requests containing SQL statements to exploit this flaw. The impact includes reading arbitrary data from the backend SQL database and performing SSRF attacks. The CVSS 3.1 base score is 7.6, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. No information about available patches or vendor advisories is provided.

An authenticated attacker with administrative privileges can exploit this vulnerability to read arbitrary content from the backend SQL database and conduct server-side request forgery attacks. This could lead to unauthorized data disclosure and potentially further internal network attacks via SSRF. There is no indication of denial of service or remote code execution impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires valid administrative credentials, restricting administrative access and monitoring for unusual administrative activity may reduce risk until a fix is applied.