The vulnerability is an XML External Entity (XXE) processing flaw in the licensing features of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-­PIC). An authenticated administrator can upload a crafted XML file to the web‑based management interface, causing the server to process external entities and read arbitrary files from the underlying operating system. This can expose sensitive data that should not be accessible even to privileged users. The weakness corresponds to CWE‑611.

Affected vendors and products are Cisco Identity Services Engine Software and Cisco ISE Passive Identity Connector. Specific version information is not provided in the advisory.

The CVSS score is 4.9, indicating moderate risk, while the EPSS score is less than 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the web interface and valid administrative credentials; therefore, the attack vector is likely local network or remote web application access, and the attacker must first authenticate as an administrator.