CVE-2026-76425

Cisco ISE SQL Injection Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.17.6High EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether your organization runs Cisco Identity Services Engine Software and identify all administrator accounts and API access points.
Restrict administrator and API access to trusted management networks, remove unused administrator accounts, and require strong multi-factor authentication where available.
Ask Cisco or your support provider for the remediation timeline; no fixed version or patch information is currently available.
Review Cisco ISE and database-access logs for unusual administrator API requests or unexpected requests to internal services.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.

In plain language

Written by AI from the record

This flaw in Cisco Identity Services Engine Software lets someone who already controls an administrator account reach its database, so businesses running it should treat it as urgent.

Authenticated remote SQL injection in Cisco Identity Services Engine Software APIs allows an administrator-level attacker to read arbitrary database content and conduct server-side request forgery.

If you're affected

Database data exposure
Internal service access
Identity-service disruption
Administrator account abuse

What is it

This is a flaw in software used to manage access to company networks and systems. It is like giving someone with a master key a way to alter the questions they ask the records room, potentially letting them look through protected records or send requests into other internal areas.

Who is affected

This matters to you if you run Cisco Identity Services Engine Software. It requires an attacker to already have valid administrative credentials, so it is only a risk when an administrator account can be compromised, misused, or accessed by an attacker.

How urgent is it

A public exploit is available, giving an attacker with administrator access a ready-made way to target the affected system. Treat this as a red-priority issue: reduce administrator and API exposure now while awaiting Cisco remediation information.

What to do — in detail

Confirm deployment by inventorying Cisco Identity Services Engine Software instances, their enabled API endpoints, and all administrator accounts. The findings do not provide affected-version ranges, fixed versions, or a patch; obtain the current vendor advisory and remediation guidance from Cisco or your support provider before scheduling an upgrade.

Until a vendor fix is available, limit administrative and API access to dedicated management networks, allow only approved administrator source addresses, remove dormant accounts, and enforce multi-factor authentication for administrative access where supported. Rotate credentials for administrator accounts that are no longer fully trusted, and investigate unusual crafted API parameters, unexpected database-query behavior, and outbound requests from Cisco ISE to internal services. CISA has not listed this CVE in KEV, so there is no CISA remediation due date.

Technical context

CVSS v3.1: 7.6 High (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). CWE-89 SQL injection in Cisco ISE APIs arises from insufficient validation of parameters concatenated into SQL queries. A remote attacker with valid administrative credentials can submit crafted requests to read arbitrary SQL database content and perform SSRF. A public exploit is available; CISA KEV does not list the CVE. EPSS is 0.3% (22nd percentile) with a flat trend. The findings provide no patch or fixed-version information.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-18Record updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Identity Services Engine SoftwareNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Scored 7.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact