A command injection flaw in Cisco Identity Services Engine allows an attacker who can authenticate with at least Read Only Admin credentials to send a crafted HTTP request and execute arbitrary commands on the underlying operating system. The insufficient input validation leads to arbitrary code execution, giving the attacker user‑level access on the OS and the possibility to elevate privileges to root. In single‑node installations the resulting compromise can render the ISE node unavailable, causing a denial‑of‑service that blocks unauthenticated endpoints from reaching the network until the node is restored.

Cisco Identity Services Engine Software is affected; no specific version information is supplied, so any deployment of this product is potentially vulnerable.

The flaw scores a CVSS of 9.9, indicating critical severity. Exploitation requires authenticated access, so the risk is concentrated on systems where Read Only Admin credentials exist. Because the vulnerability is not listed in KEV and EPSS data is unavailable, there is no current evidence of widespread exploitation, but the impact remains high should an attacker gain legitimate credentials. Attackers can launch the exploit by crafting an HTTP request directed at the vulnerable endpoint, leveraging the lack of command‑input sanitization.