CVE-2026-76428: Cisco ISE Profiler SQL Injection Vulnerability
A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.
Affected Software
Event History
Frequently Asked Questions
What level of access would an attacker need?
The attacker must be able to authenticate remotely with valid administrative credentials. The available information does not indicate that lower-privileged or unauthenticated users can exploit the issue.
What is the expected impact if exploitation succeeds?
A successful attack could allow the attacker to read information from the session database. No database modification or service-disruption impact is described.
Which products should be reviewed for exposure?
Cisco Identity Services Engine (ISE) and Cisco ISE-PIC deployments should be reviewed, particularly where administrative REST API access is available remotely.