The vulnerability is an improper access control issue classified under CWE‑284, meaning that the system does not adequately enforce permissions for certain operations. An attacker with the ability to exploit this flaw could bypass legitimate authorization checks and gain unauthorized access to sensitive functions or data within Cisco Identity Services Engine or the ISE Passive Identity Connector. This could lead to data exposure or the ability to perform privileged actions beyond the intended scope of the user.

The affected products are Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). No specific version ranges are listed in the advisory.

The CVSS score of 10 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation opportunities may be uncommon at this time, and the vulnerability is not listed in the CISA KEV catalog. The advisory does not specify the exact attack vector; however, based on the nature of improper access control in networked services, the likely attack path may be remote and could require authentication to a compromised or untrusted session.