A flaw in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector permits an authenticated remote attacker to send a specially crafted HTTP request that bypasses input validation, resulting in execution of arbitrary commands on the underlying operating system. If the attacker obtains user‑level access they can subsequently elevate privileges to root, fully compromising the affected device. In single‑node deployments, exploitation can also cause a denial of service, preventing unauthenticated endpoints from accessing the network until the node is restored.

The vulnerability affects Cisco Identity Services Engine Software and Cisco ISE Passive Identity Connector. No specific version ranges are disclosed in the advisory; the flaw is present across all released versions of these products.

The CVSS v3 score of 9.1 indicates a high‑severity remote code execution risk. The EPSS score of less than 1% suggests that, at present, exploitation is unlikely but still feasible, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have valid administrative credentials; the flaw is accessed via crafted HTTP traffic from an external network. Successful exploitation leads to full system compromise and potential DoS if the node crashes.