CVE-2026-76432: Cisco ISE path traversal in file upload

CVE-2026-76432 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is a network access control platform used to enforce security policies on corporate networks. A vulnerability in the web-based management interface could allow an authenticated administrator to write arbitrary files to the system by uploading crafted files, potentially compromising system integrity and enabling further attacks.

Technologies: Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-76432 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76432 being exploited in the wild.
How severe is CVE-2026-76432?
Medium severity, with a CVSS score of 4.9, published 16 September 2026.
Which products and versions are affected?
Cisco Identity Services Engine Multiple versions affected (see vendor advisory); Cisco Identity Services Engine Passive Identity Connector Multiple versions affected (see vendor advisory).
Is there a fix for CVE-2026-76432?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76432 attacked?
It is attacked over the network.
Am I affected by CVE-2026-76432?
Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-76432 is a path traversal vulnerability (CWE-22) in the file upload functionality of Cisco ISE and ISE-PIC's web-based management interface. The vulnerability exists because the software fails to properly validate directory traversal sequences (e.g., "../") in user-supplied file paths during the upload process. An authenticated remote attacker with administrative-level privileges can exploit this by uploading a crafted file with path traversal characters to write files to arbitrary locations on the affected device. A successful exploit allows arbitrary file write, potentially leading to system compromise. Cisco has released software updates to address this vulnerability.

Affected products

  • Cisco Identity Services Engine Multiple versions affected (see vendor advisory)
  • Cisco Identity Services Engine Passive Identity Connector Multiple versions affected (see vendor advisory)

Timeline

  • 2026-09-16: disclosed: CVE-2026-76432 published by Cisco

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.