A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of directory traversal character sequences in a user-supplied file path before the request is validated. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to delete arbitrary files and directories on the underlying operating system of the affected device.
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device.
This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76447 is a medium severity vulnerability in Cisco Identity Services Engine (ISE) Software versions 3.1.0 through 3.5.0. It involves missing authentication on a critical function in the Online Certificate Status Protocol (OCSP) responder, allowing an unauthenticated remote attacker to trigger an administrative reload of the OCSP responder's certificate and key material.
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.
This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials.
CVE-2026-20287 is a medium severity vulnerability in Cisco Identity Services Engine (ISE) Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper privilege management issues that could allow elevated privileges under certain conditions. This vulnerability was identified during Cisco's internal security review and is categorized under CWE-269. The CVSS 3.1 base score is 6.5, indicating a moderate impact primarily on confidentiality and integrity. No public exploits are known, and no patch or remediation details are provided in the available data.
CVE-2026-20286 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It allows an authenticated remote attacker with valid Administrator credentials to modify parts of the device configuration through the web-based management interface due to improper server-side authorization validation. The attacker can submit crafted HTTP requests to change descriptions of files on a specific page. No confidentiality or availability impact is reported.
CVE-2026-76438 is a medium severity vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software. It allows an authenticated remote attacker with low privileges to alter device configurations due to missing authorization checks. Exploitation requires sending a crafted HTTP request and does not impact confidentiality or availability but can impact integrity by unauthorized configuration changes.
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to.
This vulnerability exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could exploit this vulnerability by exporting the users. A successful exploit could allow the attacker to view passwords that are normally not visible to administrators.
CVE-2026-76446 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper restriction of XML external entity references in an API, which could allow an authenticated remote attacker to read specific files on the underlying operating system with the permissions of the affected process.
CVE-2026-20071 is a vulnerability in Cisco Identity Services Engine (ISE) Software affecting versions 3.1.0 through 3.5.0. It involves an authentication bypass in the SSID bring-your-own-device (BYOD) onboarding workflow, allowing an unauthenticated adjacent attacker to hijack another user's onboarding session and access protected 802.1X networks. The issue arises from insufficient authentication checks during user onboarding, enabling session takeover via spoofing and redirection to the guest web portal. The CVSS score is 3.8, indicating low severity.
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read or modify data in the underlying database.
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device.
This vulnerability exists because the affected software does not properly validate directory traversal character sequences in a user-supplied file path during the upload process. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to write files to an arbitrary location on the affected system.
CVE-2026-76448 is a medium severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It allows an authenticated remote attacker with administrative credentials to inject arbitrary SQL or HQL commands due to insufficient input validation in certain APIs. Successful exploitation could enable unauthorized viewing or modification of database data. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE software. No patch information is provided in the input data.
CVE-2026-76434 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper limitation of a pathname to a restricted directory (path traversal) in the certificate import functionality of the web-based management interface. An authenticated attacker with administrative credentials can exploit this flaw to read arbitrary files on the affected system, potentially exposing sensitive information.
A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.
This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device.
This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-20290 is a medium severity vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software's Snort 2 Detection Engine. It involves improper validation of SSL/TLS certificates during parsing, which can be exploited by an unauthenticated remote attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS).
A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.
CVE-2026-76449 is a medium severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It allows an authenticated remote attacker with administrative credentials to inject arbitrary SQL or HQL commands via insufficiently validated user input in affected APIs. Successful exploitation could enable unauthorized modification of database data. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE software.