CVE-2026-76433

Cisco Identity Services Engine Information Disclosure Vulnerability

State: Published
Severity: 5.3 Medium
Published: Sep 16, 2026
Updated: Sep 17, 2026
Reserved: Aug 19, 2026

Description

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.

This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Cisco Identity Services Engine SoftwareCisco	3.1.0Affected 3.1.0 p1Affected 3.1.0 p3Affected 3.1.0 p2Affected 3.2.0Affected 3.1.0 p4Affected 3.1.0 p5Affected 3.2.0 p1Affected 3.1.0 p6Affected 3.2.0 p2Affected 3.1.0 p7Affected 3.3.0Affected 3.2.0 p3Affected 3.2.0 p4Affected 3.1.0 p8Affected 3.2.0 p5Affected 3.2.0 p6Affected 3.1.0 p9Affected 3.3 Patch 2Affected 3.3 Patch 1Affected 3.3 Patch 3Affected 3.4.0Affected 3.2.0 p7Affected 3.3 Patch 4Affected 3.4 Patch 1Affected and 23 more versions
Cisco ISE Passive Identity ConnectorCisco	3.2.0Affected 3.1.0Affected 3.3.0Affected 3.4.0Affected 3.5.0Affected

Product

Versions

Cisco Identity Services Engine SoftwareCisco

3.1.0Affected
3.1.0 p1Affected
3.1.0 p3Affected
3.1.0 p2Affected
3.2.0Affected
3.1.0 p4Affected
3.1.0 p5Affected
3.2.0 p1Affected
3.1.0 p6Affected
3.2.0 p2Affected
3.1.0 p7Affected
3.3.0Affected
3.2.0 p3Affected
3.2.0 p4Affected
3.1.0 p8Affected
3.2.0 p5Affected
3.2.0 p6Affected
3.1.0 p9Affected
3.3 Patch 2Affected
3.3 Patch 1Affected
3.3 Patch 3Affected
3.4.0Affected
3.2.0 p7Affected
3.3 Patch 4Affected
3.4 Patch 1Affected
and 23 more versions

Cisco ISE Passive Identity ConnectorCisco

3.2.0Affected
3.1.0Affected
3.3.0Affected
3.4.0Affected
3.5.0Affected

References

cisco-sa-ise-multi-traversal-WDTgYCdn

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.