CVE-2026-76450: 
Cisco ISE vulnerability analysis and mitigation

CVE-2026-76450 is an SQL/HQL injection vulnerability in Cisco Identity Services Engine (ISE) affecting all configurations of Cisco ISE regardless of device configuration. It is part of a broader advisory (cisco-sa-ise-multisql-inject-JnHK54Rq) covering four related CVEs (CVE-2026-76448 through CVE-2026-76451). Affected versions span Cisco ISE releases 3.1 through 3.5 (including all patches up to the fixed releases), disclosed on September 16, 2026. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium) (Cisco Advisory, GitHub Advisory).

The root cause is insufficient validation of user-supplied input to affected APIs before that input is used to construct database queries, classified as CWE-564 (SQL Injection: Hibernate) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (Cisco Advisory). An attacker exploits this by sending a crafted HTTP request to a vulnerable API endpoint on the ISE or ISE-PIC device, injecting malicious SQL or HQL (Hibernate Query Language) syntax that is then executed against the underlying database. Exploitation requires valid administrative credentials and network access to the device, making this an authenticated, remote attack vector with low complexity (GitHub Advisory). The vulnerability is also mapped to CAPEC-109 (Object Relational Mapping Injection), reflecting the Hibernate ORM layer involved.

A successful exploit allows an authenticated attacker with administrative credentials to execute arbitrary SQL or HQL queries against the underlying database of the Cisco ISE or ISE-PIC device. The primary impact is a high integrity risk — the attacker can view or modify data they are not authorized to access — while confidentiality and availability are not directly impacted per the CVSS scoring. Given that Cisco ISE is a network access control and identity management platform, unauthorized modification of its database could affect authentication policies, user records, and network access decisions, potentially enabling broader unauthorized access within the environment (Cisco Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (Cisco Advisory). Cisco PSIRT notes awareness of a public announcement for the vulnerabilities but no malicious use. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for valid administrative credentials, significantly limiting the attacker pool.

1. Reconnaissance: Identify Cisco ISE or ISE-PIC instances running affected versions (3.1 through 3.5 prior to fixed patch levels) accessible over the network.
2. Credential Acquisition: Obtain valid administrative credentials for the target Cisco ISE or ISE-PIC device through phishing, credential stuffing, or insider access.
3. Identify Vulnerable API Endpoints: Authenticate to the ISE administrative interface and enumerate API endpoints that accept user-supplied input used in database query construction.
4. Craft Malicious Request: Construct an HTTP request to a vulnerable API endpoint containing injected SQL or HQL syntax (e.g., appending ' OR 1=1-- or HQL-specific payloads) designed to alter the intended database query.
5. Execute Injection: Submit the crafted request to the device; the insufficient input validation allows the injected query fragment to be executed against the underlying database.
6. View or Modify Data: Retrieve query results to access unauthorized data records, or issue data modification statements to alter ISE policy or identity data (Cisco Advisory).

• Network: Unusual or unexpected API requests to Cisco ISE administrative endpoints containing SQL metacharacters (e.g., single quotes, double dashes, OR 1=1, UNION SELECT) in query parameters or request bodies.
• Logs: Cisco ISE application logs showing database query errors, HQL parse exceptions, or anomalous query patterns originating from authenticated admin sessions; review ise-psc.log and database audit logs for unexpected query structures.
• Logs: Authentication logs showing admin account activity at unusual times or from unexpected source IP addresses, which may indicate compromised credentials used to reach the injection point.
• Database: Unexpected changes to ISE policy objects, user records, or network access rules that cannot be attributed to legitimate administrative actions.

Cisco has released fixed software versions addressing this vulnerability: ISE 3.3 Patch 12, ISE 3.4 Patch 7, and ISE 3.5 Patch 4. Releases 3.1 and 3.2 are not receiving fixes and require migration to a supported fixed release. There are no workarounds available for this vulnerability. As interim measures, organizations should restrict network access to Cisco ISE and ISE-PIC administrative interfaces to only authorized administrators, and monitor database query logs for suspicious injection attempts (Cisco Advisory).

Cisco credited Li Jiantao and Tevel Sho of STAR Labs SG Pte. Ltd. for reporting these vulnerabilities (Cisco Advisory). The advisory was published as part of Cisco's September 16, 2026 batch security advisory release. No significant independent researcher commentary or notable social media discussion has been identified beyond standard CVE tracking and aggregation sites.