This vulnerability arises from the offline profiler feed service in Cisco ISE software improperly parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. Exploitation requires valid administrative credentials and involves uploading a malicious offline feed package via the administrative interface. Successful exploitation enables reading arbitrary files from the file system and issuing requests to internal systems from the affected device. The affected versions are 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0.

An attacker with valid administrative credentials can read arbitrary files on the affected device and issue requests to internal systems, potentially exposing sensitive information. There is no indication of impact on integrity or availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to offline feed uploads. No vendor advisory or patch links are provided in the current data.