The vulnerability arises from insufficient validation of user input in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE‑PIC) APIs, allowing attackers with valid administrative credentials to inject SQL or HQL statements. Successful exploitation gives the attacker arbitrary read or write access to the underlying database, enabling them to view or modify data that they should not have access to.

Affected products include Cisco ISE Passive Identity Connector and Cisco Identity Services Engine software. Specific version ranges are not listed in the advisory, so all releases of these products that include the vulnerable APIs may be impacted.

The CVSS score of 4.9 indicates a moderate impact. The EPSS score of less than 1 percent suggests that the likelihood of exploitation is low and the vulnerability is not currently listed in the CISA KEV catalog. However, because the attack requires authenticated administrative privileges, any compromise or insider misuse of an admin account could lead to data exfiltration or alteration. The exploitation path involves an authenticated user sending a crafted request to the vulnerable API endpoint, resulting in the execution of arbitrary database queries.