# CVE-2026-76432: Cisco ISE path traversal in file upload

Source: https://junglewise.ai/threats/cve-2026-76432-cisco-ise-path-traversal-in-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76432 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is a network access control platform used to enforce security policies on corporate networks. A vulnerability in the web-based management interface could allow an authenticated administrator to write arbitrary files to the system by uploading crafted files, potentially compromising system integrity and enabling further attacks.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco Identity Services Engine Passive Identity Connector](https://junglewise.ai/threats/technologies/identity-services-engine-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76432 being exploited in the wild.

**How severe is CVE-2026-76432?** Medium severity, with a CVSS score of 4.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine Multiple versions affected (see vendor advisory); Cisco Identity Services Engine Passive Identity Connector Multiple versions affected (see vendor advisory).

**Is there a fix for CVE-2026-76432?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76432 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76432?** Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76432 is a path traversal vulnerability (CWE-22) in the file upload functionality of Cisco ISE and ISE-PIC's web-based management interface. The vulnerability exists because the software fails to properly validate directory traversal sequences (e.g., "../") in user-supplied file paths during the upload process. An authenticated remote attacker with administrative-level privileges can exploit this by uploading a crafted file with path traversal characters to write files to arbitrary locations on the affected device. A successful exploit allows arbitrary file write, potentially leading to system compromise. Cisco has released software updates to address this vulnerability.

## Affected products

- Cisco Identity Services Engine Multiple versions affected (see vendor advisory)
- Cisco Identity Services Engine Passive Identity Connector Multiple versions affected (see vendor advisory)

## Timeline

- 2026-09-16: disclosed: CVE-2026-76432 published by Cisco

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)