Description A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device.
This vulnerability exists because the affected software does not properly validate directory traversal character sequences in a user-supplied file path during the upload process. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to write files to an arbitrary location on the affected system.
Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 19, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration CWE-ID CWE Name Source CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [email protected]
Affected Products Product Versions cisco identity services engine >= 3.1.0, < 3.3.0
3.3.0 patch1
3.3.0 patch10
3.3.0 patch11
3.3.0 patch2
3.3.0 patch3
3.3.0 patch4
3.3.0 patch5
3.3.0 patch6
3.3.0 patch7
3.3.0 patch8
3.3.0 patch9
3.4.0 -
3.4.0 patch1
3.4.0 patch2
3.4.0 patch3
3.4.0 patch4
3.4.0 patch5
3.4.0 patch6
3.5.0 -
3.5.0 patch1
3.5.0 patch2
3.5.0 patch3
Viewing 5 of 23 versions. View all CPE cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch10:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch11:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch8:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch9:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch3:*:*:*:*:*:* Remediation No remediation found in references. cisco identity services engine passive identity connector >= 3.1.0, < 3.3.0
3.3.0 patch1
3.3.0 patch10
3.3.0 patch11
3.3.0 patch2
3.3.0 patch3
3.3.0 patch4
3.3.0 patch5
3.3.0 patch6
3.3.0 patch7
3.3.0 patch8
3.3.0 patch9
3.4.0 -
3.4.0 patch1
3.4.0 patch2
3.4.0 patch3
3.4.0 patch4
3.4.0 patch5
3.4.0 patch6
Viewing 5 of 19 versions. View all CPE cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch10:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch11:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch8:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch9:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch6:*:*:*:*:*:* Remediation No remediation found in references.
Change History 3 change records found show changes