# CVE-2026-76424: Cisco ISE arbitrary file upload and execution

Source: https://junglewise.ai/threats/cve-2026-76424-cisco-ise-arbitrary-file-upload-and-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76424 · Severity: high · CVSS 7.2 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is an authentication and access control platform used to manage network identity and access policies. A flaw in its REST API allows authenticated administrators with valid credentials to upload files to arbitrary locations on the device and execute arbitrary commands with root privileges, potentially compromising the entire network infrastructure managed by ISE.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76424 being exploited in the wild.

**How severe is CVE-2026-76424?** High severity, with a CVSS score of 7.2, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine See Cisco advisory for affected versions.

**Is there a fix for CVE-2026-76424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76424 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76424?** Check whether you run Cisco Identity Services Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76424 is a path traversal / arbitrary file upload vulnerability in the Cisco ISE REST API caused by insufficient validation of file operation parameters. An authenticated attacker with valid administrative credentials can upload a file with a crafted path to bypass directory restrictions and place malicious files at arbitrary locations on the affected device. A successful exploit allows execution of arbitrary commands with root privileges. The vulnerability requires network access to the REST API port and valid administrative credentials; no user interaction is needed. Cisco has released software updates to address this issue, with no known workarounds available.

## Affected products

- Cisco Identity Services Engine See Cisco advisory for affected versions

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: advisory: Cisco Security Advisory cisco-sa-ise-multi-hrP9jQSQ published

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)