CVE-2026-76450

MEDIUM 4.9

Cisco Identity Services Engine SQL Injection Vulnerability

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CWE	CWE-564
Vendor	cisco
Product	cisco identity services engine software
Ecosystems	Networking
Industries	NetworkingTelecommunications
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for cisco cisco identity services engine software

Be the first to know when new medium vulnerabilities affecting cisco cisco identity services engine software are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Cisco / Cisco Identity Services Engine Software

3.1.0 3.1.0 p1 3.1.0 p3 3.1.0 p2 3.2.0 3.1.0 p4 3.1.0 p5 3.2.0 p1 3.1.0 p6 3.2.0 p2 3.1.0 p7 3.3.0 3.2.0 p3 3.2.0 p4 3.1.0 p8 3.2.0 p5 3.2.0 p6 3.1.0 p9 3.3 Patch 2 3.3 Patch 1 3.3 Patch 3 3.4.0 3.2.0 p7 3.3 Patch 4 3.4 Patch 1 3.1.0 p10 3.3 Patch 5 3.3 Patch 6 3.4 Patch 2 3.3 Patch 7 3.4 Patch 3 3.5.0 3.4 Patch 4 3.3 Patch 8 3.2 Patch 8 3.5 Patch 1 3.3 Patch 9 3.2 Patch 9 3.4 Patch 5 3.5 Patch 3 3.5 Patch 2 3.3 Patch 10 3.3 Patch 11 3.4 Patch 6 3.2 Patch 10 3.1.0 p72 3.1.0 p11

Cisco / Cisco ISE Passive Identity Connector

3.2.0 3.1.0 3.3.0 3.4.0 3.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sec.cloudapps.cisco.com: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multisql-inject-JnHK54Rq