CVE-2026-76431 in Identity Services Engine Software
Summary
by MITRE • 09/17/2026
A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of directory traversal character sequences in a user-supplied file path before the request is validated. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to delete arbitrary files and directories on the underlying operating system of the affected device.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The identified security flaw resides within the file management subsystem of the Cisco Identity Services Engine (ISE) and its associated PIC variant, specifically affecting the web-based administrative interface. This vulnerability represents a critical failure in input validation mechanisms designed to sanitize user-supplied data before it is processed by the underlying operating system. The core technical deficiency involves an improper handling of directory traversal character sequences, such as dot-dot-slash patterns, within file path parameters. When an authenticated administrator submits a request involving file operations, the application fails to adequately validate or escape these special characters prior to passing them to the OS-level file deletion routines. This lack of rigorous sanitization allows maliciously crafted input to bypass intended access controls and reference locations outside the designated directory scope.
From an operational perspective, this vulnerability enables an authenticated remote attacker with valid administrative credentials to perform arbitrary file and directory deletions on the host operating system hosting Cisco ISE. The impact is severe because it compromises the integrity of critical system files, configuration backups, logs, or application binaries essential for the proper functioning of the identity services platform. An adversary leveraging this flaw could disrupt service availability by removing key components required for authentication, authorization, and accounting processes. Furthermore, the deletion of log files may hinder forensic analysis and incident response efforts, while the removal of security configurations could leave the network infrastructure exposed to further attacks or unauthorized access. The requirement for administrative credentials limits the attack surface to insider threats or compromised admin accounts but significantly increases the potential damage due to the high privilege level associated with such access.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended directory. Additionally, it maps to MITRE ATT&CK technique T1070.003: Indicator Removal on Host via File Deletion, as the exploitation involves removing evidence or critical system components from the host environment. The attack vector is classified under Remote Code Execution principles in terms of impact, though technically it manifests as a denial of service and integrity violation through file manipulation rather than direct code execution.
Mitigation strategies should prioritize immediate patching to the latest recommended version of Cisco ISE that addresses this specific input validation flaw. In environments where patching cannot be applied immediately, network segmentation policies should restrict access to the management interface exclusively from trusted administrative subnets using firewalls or ACLs. Implementing strict web application firewall rules can also help by detecting and blocking requests containing directory traversal sequences in file path parameters. Regular auditing of administrative account usage and monitoring for unusual file system changes on the host OS are recommended defensive measures to detect potential exploitation attempts early.