SQL Injection Vulnerability in Cisco Identity Services Engine and Its Passive Connector

CVE-2026-76450

What is CVE-2026-76450?

A vulnerability exists in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that enables an authenticated remote attacker to execute SQL or HQL injection attacks. This flaw arises from inadequate validation of user-supplied inputs of the affected APIs, which are leveraged to construct database queries. By sending a specially crafted request, an attacker with prior administrative credentials can exploit this vulnerability to run arbitrary SQL or HQL queries against the database. This could result in unauthorized viewing or modification of sensitive data.

References