This vulnerability arises from insufficient authentication enforcement on a specific API endpoint in Cisco Identity Services Engine software. An unauthenticated attacker can send a specially crafted request to this endpoint to bypass authentication mechanisms. Successful exploitation results in unauthorized access to the affected device, compromising confidentiality, integrity, and availability. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 3.4.0 and 3.5.0.

An attacker exploiting this vulnerability can gain unauthorized administrative access to the Cisco ISE device by bypassing authentication controls. This can lead to full compromise of the device, including control over its management interface and potentially the network services it governs. The impact is critical, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Cisco's advisories closely for updates. Until a fix is available, restrict network access to the affected API endpoints where possible and apply compensating controls to limit exposure.