CVE-2026-76449

Cisco Identity Services Engine SQL Injection Vulnerability

State: Published
Severity: 4.9 Medium
Published: Sep 16, 2026
Updated: Sep 17, 2026
Reserved: Aug 19, 2026

Description

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.

This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N	cisco

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Cisco Identity Services Engine SoftwareCisco	3.1.0Affected 3.1.0 p1Affected 3.1.0 p3Affected 3.1.0 p2Affected 3.2.0Affected 3.1.0 p4Affected 3.1.0 p5Affected 3.2.0 p1Affected 3.1.0 p6Affected 3.2.0 p2Affected 3.1.0 p7Affected 3.3.0Affected 3.2.0 p3Affected 3.2.0 p4Affected 3.1.0 p8Affected 3.2.0 p5Affected 3.2.0 p6Affected 3.1.0 p9Affected 3.3 Patch 2Affected 3.3 Patch 1Affected 3.3 Patch 3Affected 3.4.0Affected 3.2.0 p7Affected 3.3 Patch 4Affected 3.4 Patch 1Affected and 24 more versions
Cisco ISE Passive Identity ConnectorCisco	3.2.0Affected 3.1.0Affected 3.3.0Affected 3.4.0Affected 3.5.0Affected

Product

Versions

Cisco Identity Services Engine SoftwareCisco

3.1.0Affected
3.1.0 p1Affected
3.1.0 p3Affected
3.1.0 p2Affected
3.2.0Affected
3.1.0 p4Affected
3.1.0 p5Affected
3.2.0 p1Affected
3.1.0 p6Affected
3.2.0 p2Affected
3.1.0 p7Affected
3.3.0Affected
3.2.0 p3Affected
3.2.0 p4Affected
3.1.0 p8Affected
3.2.0 p5Affected
3.2.0 p6Affected
3.1.0 p9Affected
3.3 Patch 2Affected
3.3 Patch 1Affected
3.3 Patch 3Affected
3.4.0Affected
3.2.0 p7Affected
3.3 Patch 4Affected
3.4 Patch 1Affected
and 24 more versions

Cisco ISE Passive Identity ConnectorCisco

3.2.0Affected
3.1.0Affected
3.3.0Affected
3.4.0Affected
3.5.0Affected

References

cisco-sa-ise-multisql-inject-JnHK54Rq

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.