CVE-2026-76427 in Identity Services Engine Software
Summary
by MITRE • 09/17/2026
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device.
This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The identified security flaw resides within the offline profiler feed service of Cisco Identity Services Engine, a critical network access control platform used for managing user and device authentication across enterprise networks. This vulnerability specifically impacts the mechanism by which administrators upload external data packages to update profiling information about devices on the network. The core technical deficiency is an XML External Entity (XXE) injection flaw caused by the improper configuration of the XML parser utilized during the processing of feed metadata files. Specifically, the parser fails to disable support for resolving external entities and general entity references when parsing user-supplied input. This misconfiguration allows an attacker who has successfully uploaded a maliciously crafted offline feed package through the administrative interface to inject arbitrary system-level file paths or network endpoints into the XML structure. When the vulnerable service processes this metadata, it resolves these external entities against the local filesystem or internal network resources rather than treating them as simple text strings.
From an operational perspective, the exploitation of this vulnerability yields significant consequences for organizational security posture. An authenticated attacker with administrative privileges can leverage this flaw to perform server-side request forgery and arbitrary file read operations. By crafting specific XML payloads that reference local paths such as configuration files or credential stores, the attacker can extract sensitive data directly from the device's operating system. Furthermore, because the vulnerable service operates on behalf of the ISE appliance, it possesses network connectivity to other internal systems. This capability enables the attacker to use the compromised server as a pivot point to issue requests to backend databases, authentication servers, or other critical infrastructure components that may not be directly accessible from external networks. The requirement for valid administrative credentials limits the attack surface to insider threats or scenarios where an attacker has already achieved initial access and privilege escalation within the management plane of the ISE deployment.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-611, which describes Improper Restriction of XML External Entity Reference. The exploitation technique is consistent with MITRE ATT&CK tactic T1552.004, specifically Unsecured Credentials or Credential Dumping via local file access, and potentially T1078 Valid Accounts if the attacker leverages stolen administrative credentials to initiate the upload process. To mitigate this risk, organizations must ensure that their Cisco ISE deployments are updated with the latest software patches provided by the vendor, which address the XML parsing logic to strictly prohibit external entity resolution for untrusted input. Additionally, administrators should enforce strict access controls on the management interface, ensuring that only trusted personnel have administrative privileges and that multi-factor authentication is enabled where supported. Network segmentation strategies should also be reviewed to limit the ability of any compromised management node to communicate with sensitive backend systems, thereby reducing the blast radius in the event of a successful exploitation attempt.