Is CVE-2026-76424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76424 being exploited in the wild.

How severe is CVE-2026-76424?

High severity, with a CVSS score of 7.2, published 16 September 2026.

Which products and versions are affected?

Cisco Identity Services Engine See Cisco advisory for affected versions.

Is there a fix for CVE-2026-76424?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76424 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76424?

Check whether you run Cisco Identity Services Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76424: Cisco ISE arbitrary file upload and execution

CVE-2026-76424 · Severity: high · CVSS 7.2 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is an authentication and access control platform used to manage network identity and access policies. A flaw in its REST API allows authenticated administrators with valid credentials to upload files to arbitrary locations on the device and execute arbitrary commands with root privileges, potentially compromising the entire network infrastructure managed by ISE.

Technologies: Cisco Identity Services Engine. Vendors: Cisco.

Quick answers

Is CVE-2026-76424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76424 being exploited in the wild.
How severe is CVE-2026-76424?: High severity, with a CVSS score of 7.2, published 16 September 2026.
Which products and versions are affected?: Cisco Identity Services Engine See Cisco advisory for affected versions.
Is there a fix for CVE-2026-76424?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76424 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76424?: Check whether you run Cisco Identity Services Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-76424 is a path traversal / arbitrary file upload vulnerability in the Cisco ISE REST API caused by insufficient validation of file operation parameters. An authenticated attacker with valid administrative credentials can upload a file with a crafted path to bypass directory restrictions and place malicious files at arbitrary locations on the affected device. A successful exploit allows execution of arbitrary commands with root privileges. The vulnerability requires network access to the REST API port and valid administrative credentials; no user interaction is needed. Cisco has released software updates to address this issue, with no known workarounds available.

Affected products

Cisco Identity Services Engine See Cisco advisory for affected versions

Timeline

2026-09-16: disclosed
2026-09-16: advisory: Cisco Security Advisory cisco-sa-ise-multi-hrP9jQSQ published

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.