CVE-2026-76428

Cisco ISE Profiler SQL Injection Vulnerability

No known exploitation. EPSS puts it in the 41st percentile. Fixed in 3.3.0.

CVSS 3.14.9Medium EPSS percentile41st0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix3.3.0Upgrade to this build

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157979

Run the check

Published 2026-09-16Updated 2026-09-28Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Cisco Identity Services Engine SoftwareAffected: 3.1.0Upgrade to: not statedAffected: 3.1.0 p1Upgrade to: not statedAffected: 3.1.0 p3Upgrade to: not statedAffected: 3.1.0 p2Upgrade to: not stated + 44 more branchesStated by: CVE record
Cisco ISE Passive Identity ConnectorAffected: 3.2.0Upgrade to: not statedAffected: 3.1.0Upgrade to: not statedAffected: 3.3.0Upgrade to: not statedAffected: 3.4.0Upgrade to: not stated + 1 more branchStated by: CVE record
Cisco Identity Services EngineAffected: ≥ 3.1.0, < 3.3.0Upgrade to: 3.3.0Stated by: NVD
Cisco Identity Services Engine Passive Identity ConnectorAffected: ≥ 3.1.0, < 3.3.0Upgrade to: 3.3.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Cisco Identity Services Engine software or Cisco ISE Passive Identity Connector and identify who has administrator access.
Ask Cisco or your support provider whether your installed version is affected; no fixed version has been announced.
Restrict administrator accounts to essential staff, review recent administrator activity, and remove unused accounts.
Watch for Cisco security updates and apply the vendor-provided fix when it becomes available.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.

In plain language

Written by AI from the record

This affects Cisco Identity Services Engine software and Cisco ISE Passive Identity Connector; affected versions are not yet known, but a logged-in administrator could use the flaw to read session-database information.

Authenticated remote SQL injection in Cisco ISE and Cisco ISE-PIC REST APIs lets an administrator inject SQL through improperly parameterized session-database query parameters and read database information.

If you're affected

Session database data exposure
User activity data exposure
Identity system privacy risk

What is it

A flaw in the product's management interface can let someone with administrator access ask the session database questions it was not meant to answer. It is like giving a building manager a filing-cabinet key that also lets them slip in extra instructions to see restricted records.

Who is affected

This matters to you if you run Cisco Identity Services Engine software or Cisco ISE Passive Identity Connector. It requires an attacker to already have valid administrator credentials and be able to reach the affected management interface.

How urgent is it

A public exploit is available, so treat this as urgent and tightly control administrator access now. The flaw requires administrator credentials, but those accounts provide a direct route to session-database information.

What to do — in detail

Confirm whether Cisco ISE or Cisco ISE-PIC is deployed, which REST API interfaces are reachable, and which accounts hold administrative privileges. Review the affected system's version with Cisco support because no affected-version range or fixed release is available in the current findings.

There is no announced fixed version or supported upgrade path yet. If patching is delayed, limit administrative access to trusted management networks, require strong authentication for administrator accounts, remove dormant administrator accounts, and review administrator API activity for unusual crafted requests or unexpected database-query behavior.

No CISA KEV due date applies because this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Monitor Cisco advisories for fixed releases and review logs for suspicious requests to the REST APIs and unexpected session-database reads.

Technical context

CVSS v3.1 is 4.9 (Medium): AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The weakness is CWE-89 SQL injection in REST API parameters concatenated into SQL clauses without parameterization, enabling an authenticated remote administrator to read session-database information. A public exploit is available; CISA KEV does not list this CVE. EPSS is 0.4% (31st percentile) with a flat trend; this is a prediction, not confirmation of exploitation. No patch information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS41st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 41st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-28Patch availablerecord updated
2026-09-18Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Scored 4.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact