CVE-2026-76424
Cisco ISE Arbitrary File Access Vulnerability
Severity
High 7.2
CVSS 3.1
Exploited
Not listed
EPSS
0.006
48.2th percentile
Discovered by
Vendor
Vendor-published field
Published
Sep 16, 2026
Assigned by cisco
Description
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
Weakness: CWE-23
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine (ISE) | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Identity Services Engine Software