Riskcovery

CVE-2026-76448

Cisco Identity Services Engine SQL Injection Vulnerability

State
Published
Severity
4.9 Medium
Published
Sep 16, 2026
Updated
Sep 17, 2026
Reserved
Aug 19, 2026

Read the record on cve.org

Description

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.

This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Ncisco

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
Cisco Identity Services Engine SoftwareCisco
  • 3.1.0Affected
  • 3.1.0 p1Affected
  • 3.1.0 p3Affected
  • 3.1.0 p2Affected
  • 3.2.0Affected
  • 3.1.0 p4Affected
  • 3.1.0 p5Affected
  • 3.2.0 p1Affected
  • 3.1.0 p6Affected
  • 3.2.0 p2Affected
  • 3.1.0 p7Affected
  • 3.3.0Affected
  • 3.2.0 p3Affected
  • 3.2.0 p4Affected
  • 3.1.0 p8Affected
  • 3.2.0 p5Affected
  • 3.2.0 p6Affected
  • 3.1.0 p9Affected
  • 3.3 Patch 2Affected
  • 3.3 Patch 1Affected
  • 3.3 Patch 3Affected
  • 3.4.0Affected
  • 3.2.0 p7Affected
  • 3.3 Patch 4Affected
  • 3.4 Patch 1Affected
  • and 22 more versions
Cisco ISE Passive Identity ConnectorCisco
  • 3.2.0Affected
  • 3.1.0Affected
  • 3.3.0Affected
  • 3.4.0Affected
  • 3.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.