This vulnerability arises from insufficient validation of user-supplied input in APIs of Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. An attacker with valid administrative credentials can send crafted requests to inject SQL or HQL commands, potentially leading to unauthorized data modification or access within the underlying database. The affected versions explicitly include 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. The CVSS 3.1 base score is 4.9, indicating medium severity with high impact on integrity but no impact on confidentiality or availability.

An authenticated attacker with administrative privileges can exploit this vulnerability to execute arbitrary SQL or HQL queries on the backend database. This could allow unauthorized modification of data, potentially compromising the integrity of the system's data. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Since the vulnerability requires administrative credentials, limiting access to trusted administrators and monitoring for unusual administrative activity is recommended until an official fix is available.