This vulnerability in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE‑PIC) stems from insufficient validation of user‑supplied input in HTTP requests. An attacker who is authenticated with administrator credentials can send a specially crafted request that is executed on the underlying operating system. Successful exploitation initially grants user‑level access, after which the attacker can elevate privileges to root, enabling arbitrary command execution on the host and potentially leading to a denial‑of‑service if a single‑node ISE node is taken offline.

The vulnerability affects Cisco ISE Passive Identity Connector and Cisco Identity Services Engine Software. No specific version numbers are disclosed in the advisory, so the scope of affected releases cannot be determined from the available data.

The CVSS score of 9.9 classifies this flaw as critical. The EPSS score of 11% indicates a moderate probability that attackers will attempt exploitation. Since it is not listed in the CISA KEV catalog, no publicly known exploit is documented. Exploitation requires authenticated access to the ISE web interface and delivery of a crafted HTTP request; upon success, the attacker obtains full control of the underlying operating system.