CVE-2026-76432
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level pr…
Impact
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validate directory traversal character sequences in a user-supplied file path during the upload process. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to write files to an arbitrary location on the affected system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Identity Services Engine | from 3.1.0 before 3.3.0 Versions 3.3.0, 3.4.0, 3.5.0 |
| Cisco | Identity Services Engine Passive Identity Connector | from 3.1.0 before 3.3.0 Versions 3.3.0, 3.4.0 |