CVE-2026-76427

Cisco ISE XML External Entity Injection Vulnerability

No known exploitation. EPSS puts it in the 40th percentile. Fixed in 3.3.0.

CVSS 3.14.9Medium EPSS percentile40th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix3.3.0Upgrade to this build

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157979

Run the check

Published 2026-09-16Updated 2026-09-28Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Cisco Identity Services Engine SoftwareAffected: 3.1.0Upgrade to: not statedAffected: 3.1.0 p1Upgrade to: not statedAffected: 3.1.0 p3Upgrade to: not statedAffected: 3.1.0 p2Upgrade to: not stated + 44 more branchesStated by: CVE record
Cisco ISE Passive Identity ConnectorAffected: 3.2.0Upgrade to: not statedAffected: 3.1.0Upgrade to: not statedAffected: 3.3.0Upgrade to: not statedAffected: 3.4.0Upgrade to: not stated + 1 more branchStated by: CVE record
Cisco Identity Services EngineAffected: ≥ 3.1.0, < 3.3.0Upgrade to: 3.3.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Cisco Identity Services Engine software and whether administrators can upload offline profiler feed packages.
Restrict administrator accounts to essential staff, remove unused accounts, and require strong sign-in protection for remaining administrators.
No fixed version has been published in the available findings; ask Cisco or your support partner for the applicable fixed release before upgrading.
Until a fix is available, disable or tightly control offline profiler feed uploads and review administrator activity for unexpected uploads.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

In plain language

Written by AI from the record

This affects Cisco Identity Services Engine software; an attacker with an administrator account may be able to read sensitive files, and no vendor fix information is available.

Authenticated remote XML external entity injection in Cisco ISE’s offline profiler feed service lets an administrator-uploaded crafted feed read arbitrary local files and make requests to internal systems.

If you're affected

Sensitive file exposure
Internal system probing
Identity service risk
Administrative account abuse

What is it

This is a flaw in a feature that processes uploaded information for Cisco Identity Services Engine software. It is like giving a building manager a document to file, but the document tricks them into opening other locked cabinets and reporting back what is inside.

Who is affected

This matters to you if you run Cisco Identity Services Engine software, including its Passive Identity Connector, and use the offline profiler feed service. It requires an attacker to already have valid administrator credentials and access to the administrative interface.

How urgent is it

A public exploit is available, so treat this as urgent even though an attacker needs an administrator account first. Secure those accounts and restrict the affected upload feature now while you obtain Cisco’s remediation guidance.

What to do — in detail

Confirm whether the Cisco ISE offline profiler feed service is present and whether the administrative interface permits offline feed-package uploads. Review all administrator accounts, recent administrator logins, and upload records for unfamiliar feed packages; investigate unexpected outbound requests from the ISE appliance to internal systems.

No fixed versions or vendor patch details are available in the findings. Do not assume a particular release is safe; obtain the fixed-version guidance from Cisco or your authorized support partner, then follow its documented upgrade path and compatibility notes before deploying.

If patching is delayed, disable the offline profiler feed upload workflow where operationally possible, or limit it to a tightly controlled administrator group. Rotate credentials for unnecessary or suspected administrator accounts, and monitor for unexpected uploads, unusual file-access behavior, and requests from ISE to internal services. CISA has not listed this CVE in KEV, so there is no CISA remediation due date.

Technical context

CVE-2026-76427 is rated CVSS 4.9 (Medium): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The weakness is CWE-611 XML External Entity Injection in parsing attacker-controlled offline profiler feed metadata. An authenticated remote attacker with valid administrative credentials can upload a crafted package through the administrative interface to read arbitrary files and issue requests to internal systems. A public exploit is available. CISA KEV does not list this CVE. EPSS is 0.3% (27th percentile) with a flat trend; this is a prediction, not confirmation of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS40th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 40th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-28Patch availablerecord updated
2026-09-18Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Scored 4.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact