This vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) arises from insufficient validation of user-supplied input to APIs that build database queries. An attacker with valid administrative credentials can send crafted requests to execute arbitrary SQL or HQL queries against the backend database. This could allow unauthorized viewing or modification of data. The vulnerability affects versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0 of Cisco ISE software. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with valid administrative credentials can exploit this vulnerability to execute arbitrary SQL or HQL commands on the affected device's database. This could lead to unauthorized modification of data, potentially impacting the integrity of the system's stored information. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires valid administrative credentials, limiting administrative access and monitoring for suspicious activity is advisable until an official fix is available.