CVE-2026-76424
Cisco ISE Arbitrary File Access Vulnerability
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Aug 19, 2026
Description
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device.
This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | cisco |
Weaknesses
- CWE-23 Relative Path Traversal
Affected Products
| Product | Versions |
|---|---|
Cisco Identity Services Engine SoftwareCisco |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.