CVE-2026-76448: Cisco Identity Services Engine SQL and HQL injection

CVE-2026-76448 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) are identity and access management systems that control user authentication and authorization across networks. An authenticated administrator with valid credentials can inject malicious SQL or HQL queries through vulnerable APIs, potentially allowing them to view, modify, or delete sensitive user identity data stored in the underlying database. An attacker with compromised administrative credentials could escalate their access or manipulate identity records to bypass security controls.

Technologies: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-76448 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76448 being exploited in the wild.
How severe is CVE-2026-76448?
Medium severity, with a CVSS score of 4.9, published 16 September 2026.
Which products and versions are affected?
Cisco Identity Services Engine 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7), 3.5 (before Patch 4); Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7).
Is there a fix for CVE-2026-76448?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76448 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76448?
Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple SQL and HQL injection vulnerabilities exist in Cisco ISE and ISE-PIC due to insufficient input validation on affected APIs before the input is used to construct database queries (CWE-89, CWE-564). An authenticated remote attacker with valid administrative credentials can exploit these vulnerabilities by sending a crafted request to the affected device. A successful exploit allows execution of arbitrary SQL or HQL queries against the underlying database, potentially enabling unauthorized data access, modification, or deletion. Cisco has released software patches: ISE 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 contain the fixes. ISE 3.1 and 3.2 reached end-of-support and require migration to a fixed release.

Affected products

  • Cisco Identity Services Engine 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7), 3.5 (before Patch 4)
  • Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7)

Timeline

  • 2026-09-16: disclosed: Cisco security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.