# CVE-2026-76449: Cisco ISE SQL/HQL injection in APIs

Source: https://junglewise.ai/threats/cve-2026-76449-cisco-ise-sql-hql-injection-in-apis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76449 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) are identity management and network access control products used by enterprises to manage authentication and authorization. A flaw in API input validation allows authenticated administrators to inject malicious SQL/HQL queries into the underlying database, enabling unauthorized access to or modification of sensitive identity and network data. This could expose user credentials, security policies, and network access logs.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco ISE Passive Identity Connector](https://junglewise.ai/threats/technologies/ise-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76449 being exploited in the wild.

**How severe is CVE-2026-76449?** Medium severity, with a CVSS score of 4.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine 3.1, 3.2, 3.3 (before patch 12), 3.4 (before patch 7), 3.5 (before patch 4); Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before patch 12), 3.4 (before patch 7).

**Is there a fix for CVE-2026-76449?** A patch was published on 2026-09-16: Patches released: ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76449 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-76449?** Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a SQL/HQL injection flaw (CWE-89, CWE-564) in multiple APIs within Cisco ISE and ISE-PIC. The root cause is insufficient validation of user-supplied input before database query construction. An authenticated attacker with valid administrative credentials can send a crafted API request to an affected device to execute arbitrary SQL or HQL queries against the underlying database. A successful exploit allows viewing or modifying unauthorized data. The vulnerability requires network access and valid admin credentials. Cisco has released patches: ISE 3.3 Patch 12, ISE 3.4 Patch 7, and ISE 3.5 Patch 4 and later address the issue. No workarounds are available.

## Affected products

- Cisco Identity Services Engine 3.1, 3.2, 3.3 (before patch 12), 3.4 (before patch 7), 3.5 (before patch 4)
- Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before patch 12), 3.4 (before patch 7)

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released: ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multisql-inject-JnHK54Rq](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multisql-inject-JnHK54Rq)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)