A flaw in Cisco ISE and Cisco ISE‑PIC arises from insufficient validation of user input in a HTTP request, allowing a remote attacker with valid administrative credentials to run arbitrary commands on the host operating system. If the exploit succeeds, the attacker first gains user‑level access and can then elevate privileges to root. In addition, a single‑node ISE deployment can be brought down, causing a denial of service that isolates endpoints until the node is restored.

The vulnerability affects Cisco ISE Passive Identity Connector and Cisco Identity Services Engine Software. No specific version information is disclosed, implying that all current releases are potentially impacted until a patch is released by Cisco.

The CVSS score of 9.9 indicates a critical level of threat, but the EPSS score is not available, so the current exploitation probability remains uncertain. The vulnerability is not listed in the CISA KEV catalog. The attacker must be authenticated as an administrator on the device, obtained via legitimate credentials, then send a crafted HTTP request from a remote network. Successful exploitation would provide the attacker with full control over the underlying operating system, enabling data theft, persistence or the shutdown of the ISE node, which would disrupt network authentication for all un‑authenticated endpoints.