# CVE-2026-76434: Cisco ISE path traversal in certificate import

Source: https://junglewise.ai/threats/cve-2026-76434-cisco-ise-path-traversal-in-certificate-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76434 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) and ISE-PIC, which are identity and access management systems used to control network authentication and authorization, contain a path traversal vulnerability in the certificate management interface. An authenticated attacker with administrative credentials can exploit this flaw to read arbitrary files from the affected system, potentially exposing sensitive configuration data, credentials, or other confidential information stored on the device.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco ISE Passive Identity Connector](https://junglewise.ai/threats/technologies/ise-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76434 being exploited in the wild.

**How severe is CVE-2026-76434?** Medium severity, with a CVSS score of 4.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine multiple versions; Cisco ISE Passive Identity Connector multiple versions.

**Is there a fix for CVE-2026-76434?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76434 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76434?** Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability (CWE-22) in the certificate import functionality of the web-based management interface. The root cause is insufficient validation of directory traversal sequences (e.g., "../") in user-supplied file paths during certificate import operations. The vulnerability requires network access and valid administrative credentials to exploit. An authenticated remote attacker can send a crafted request containing path traversal payloads to the web interface, allowing them to read arbitrary files outside the intended directory. Cisco has released software patches to address this vulnerability; no workarounds are available.

## Affected products

- Cisco Identity Services Engine multiple versions
- Cisco ISE Passive Identity Connector multiple versions

## Timeline

- 2026-09-16: disclosed: CVE-2026-76434 published

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)