CVE-2026-76425: Cisco ISE SQL Injection Vulnerability
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires a remote attacker to authenticate with valid Cisco ISE administrative credentials. The attack can be performed over the network and does not require user interaction.
What could a successful attacker do?
An attacker could read arbitrary content from the backend SQL database. They could also use the issue to conduct server-side request forgery attacks.
What does the attack involve?
The attacker sends a crafted request containing SQL statements to an affected API endpoint. The vulnerable parameters are concatenated directly into an SQL query without sufficient validation.