Description A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device.
This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific files on the affected system that the underlying process has permission to access.
Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 17, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions cisco identity services engine < 3.3.0
3.3.0 patch1
3.3.0 patch10
3.3.0 patch11
3.3.0 patch2
3.3.0 patch3
3.3.0 patch4
3.3.0 patch5
3.3.0 patch6
3.3.0 patch7
3.3.0 patch8
3.3.0 patch9
3.4.0 -
3.4.0 patch1
3.4.0 patch2
3.4.0 patch3
3.4.0 patch4
3.4.0 patch5
3.4.0 patch6
3.5.0 -
3.5.0 patch1
3.5.0 patch2
3.5.0 patch3
Viewing 5 of 23 versions. View all CPE cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch10:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch11:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch8:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch9:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch3:*:*:*:*:*:* Remediation No remediation found in references. cisco identity services engine passive identity connector < 3.3.0
3.3.0 patch1
3.3.0 patch10
3.3.0 patch11
3.3.0 patch2
3.3.0 patch3
3.3.0 patch4
3.3.0 patch5
3.3.0 patch6
3.3.0 patch7
3.3.0 patch8
3.3.0 patch9
3.4.0 -
3.4.0 patch1
3.4.0 patch2
3.4.0 patch3
3.4.0 patch4
3.4.0 patch5
3.4.0 patch6
Viewing 5 of 19 versions. View all CPE cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch10:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch11:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch8:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch9:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch6:*:*:*:*:*:* Remediation No remediation found in references.
Change History 4 change records found show changes