This vulnerability exists in an API of Cisco ISE and Cisco ISE-PIC due to improper restriction of XML external entity references. An authenticated remote attacker can exploit this by sending a crafted request to the affected device, enabling reading of specific files on the underlying OS that the process has permission to access. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality.

Successful exploitation allows an authenticated attacker to read specific files on the affected system, potentially exposing sensitive information. There is no impact on integrity or availability. The attacker must have high privileges (authenticated access) to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected API to trusted users only and monitor for suspicious activity involving XML input processing.