CVE-2026-76451: Cisco ISE SQL and HQL injection in APIs

CVE-2026-76451 · Severity: medium · CVSS 4.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is an authentication and access control platform used to manage network identity and access policies. An authenticated attacker with administrative credentials can exploit SQL/HQL injection vulnerabilities in ISE APIs to read or modify sensitive data in the underlying database without authorization. The vulnerability requires valid admin credentials to exploit, limiting risk to insider threats and compromised admin accounts.

Technologies: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-76451 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76451 being exploited in the wild.
How severe is CVE-2026-76451?
Medium severity, with a CVSS score of 4.9, published 16 September 2026.
Which products and versions are affected?
Cisco Identity Services Engine 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7), 3.5 (before Patch 4); Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7).
Is there a fix for CVE-2026-76451?
A patch was published on 2026-09-16: Fixed versions available: ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76451 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76451?
Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL/HQL injection flaw (CWE-89) resulting from insufficient input validation in affected APIs before user-supplied data is incorporated into database queries. An authenticated attacker with administrative credentials can send crafted requests to exploit the vulnerability and execute arbitrary SQL or HQL queries against the database. A successful exploit allows unauthorized viewing or modification of data stored in the database. The attack requires network access, valid administrative credentials, and no user interaction. Cisco has released patched software versions (ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4, and later); no workarounds exist.

Affected products

  • Cisco Identity Services Engine 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7), 3.5 (before Patch 4)
  • Cisco ISE Passive Identity Connector 3.1, 3.2, 3.3 (before Patch 12), 3.4 (before Patch 7)

Timeline

  • 2026-09-16: disclosed: Cisco security advisory published
  • 2026-09-16: patched: Fixed versions available: ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.