AI analysis
CVE-2026-76426 is a SQL injection flaw (CWE-89) in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC (Passive Identity Connector), caused by insufficient validation of specific parameters that are concatenated into an SQL statement targeting the monitoring database. An attacker triggers it by sending a crafted REST API request containing SQL statements in one of the affected parameters, but must already hold valid administrative credentials. A successful exploit allows the attacker to read information from the monitoring database, with confidentiality impact only (CVSS 3.1 score of 4.9, medium). All organizations running ISE or ISE-PIC are potentially affected, though exploitation requires high-privilege access. No public proof-of-concept or confirmed exploitation of this specific flaw is known; however, related reporting describes a separate, actively exploited Cisco ISE zero-day authentication bypass (CVSS 10.0), so ISE administrators should patch urgently.
What to do: Upgrade ISE and ISE-PIC to the fixed releases identified in Cisco's advisory (version numbers not provided in the available data). Since exploitation requires valid administrative credentials, restrict and audit admin accounts, limit REST API access to trusted management networks, and review monitoring-database query and REST API logs for anomalous SQL content. Also monitor for the separately reported, actively exploited ISE authentication zero-day and check systems for signs of compromise.
Affected
| Cisco Identity Services Engine (ISE) | — |
| Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) | — |
Estimated exposure
large≈10,000–100,000 ISE/ISE-PIC deployments worldwide (estimated; no public install counts) — Cisco ISE is the company's flagship enterprise network access control/policy platform, typically deployed as appliance clusters in large enterprises, universities and government networks, so the order of magnitude is inferred from its…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials.