This vulnerability exists in the file management function of the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC. An authenticated remote attacker with valid administrative credentials can exploit improper validation of directory traversal character sequences in user-supplied file paths to delete arbitrary files and directories on the underlying operating system. Exploitation requires sending a crafted request to the management interface. The CVSS 3.1 base score is 4.9, reflecting low attack complexity but requiring high privileges and no user interaction.

Successful exploitation allows an attacker with administrative credentials to delete arbitrary files and directories on the affected device's operating system, potentially disrupting system functionality or causing denial of service. There is no confidentiality or availability impact noted, but integrity is impacted due to unauthorized file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Since exploitation requires valid administrative credentials, enforcing strong authentication and access controls is critical.