A flaw in Cisco Identity Services Engine (ISE) that allows an authenticated, remote attacker to send a specially crafted HTTP request to the ISE web interface. The insufficient validation of user input means the attacker can inject operating‑system commands. Once an exploit succeeds, the attacker gains user‑level access to the underlying OS and can then elevate privileges to root, giving full control over the device. In single‑node deployments, the attack can also crash the ISE node, causing a denial of service that blocks new endpoint authentications until the node is recovered.

The vulnerability affects Cisco Identity Services Engine Software. No specific version numbers are disclosed in the advisory, so all deployments of ISE that have not applied a patch should be considered potentially vulnerable.

The vulnerability is rated CVSS 9.9, indicating a high severity level. The advisement does not list an EPSS score or a KEV designation. The attack requires remote access to the ISE management interface and the presence of a Read‑Only Admin credential, but it does not rely on other uncommon prerequisites. Because the vector is remote over HTTP, attackers with sufficient network access could launch the exploit without interacting with local users. The combined impact on confidentiality, integrity, and availability makes this an urgent risk that should be addressed promptly.