API Vulnerability in Cisco ISE and ISE-PIC

CVE-2026-76446

What is CVE-2026-76446?

A security vulnerability exists within the API of Cisco Identity Services Engine (ISE) and ISE-PIC, enabling an authenticated remote attacker to gain unauthorized access to sensitive files on the device's operating system. This flaw stems from inadequate restrictions on XML external entity references, allowing an attacker to craft a malicious request to exploit the vulnerability. If successful, the attacker can read specific files that the process has permission to access, potentially leading to further system compromise. For more details, visit the official Cisco advisory.

References