CVE-2026-76425

Cisco Identity Services Engine (ISE) contains a SQL injection flaw in its APIs caused by insufficient validation of parameters that are concatenated directly into backend database queries. An attacker who sends a specially crafted request containing SQL statements to an affected API endpoint can trigger the flaw, but valid administrative credentials are required to do so. A successful exploit allows the attacker to read arbitrary content from the SQL database and to conduct server-side request forgery (SSRF) attacks. All organizations running affected releases of Cisco ISE are potentially affected, though exploitation requires a privileged attacker account. As of now there is no evidence of in-the-wild exploitation and no public proof-of-concept is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Check the Cisco PSIRT advisory for CVE-2026-76425 and upgrade ISE to a fixed release as soon as one is identified. Because exploitation requires valid administrative credentials, restrict access to the ISE admin and API interfaces to trusted management networks, enforce strong authentication and least privilege for admin accounts, and audit/rotate administrative credentials. Monitor API logs for unexpected queries and outbound requests that could indicate attempted SSRF.