CVE-2026-76446: falha de média gravidade em Cisco Identity Services Engine Software
Cisco Identity Services Engine External Entity Injection Vulnerability
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Cisco Identity Services Engine+ Monitorar Cisco ISE Passive Identity Connector
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 0.4%
A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device.
This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific files on the affected system that the underlying process has permission to access.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Cisco · Cisco Identity Services Engine SoftwareCisco · Cisco ISE Passive Identity ConnectorCVEs relacionadas — Cisco Identity Services Engine Software
No mesmo produto, das mais perigosas para as menos.
CVE-2025-20281CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 97.6%KEVCVE-2026-76460CRITICALCisco Identity Services Engine Authentication Bypass VulnerabilityEPSS 75.6%KEVCVE-2025-20337CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 74.5%KEVCVE-2025-20282CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 38.7%CVE-2022-20964MEDIUMCVE-2022-20964EPSS 30.6%CVE-2022-20966MEDIUMCVE-2022-20966EPSS 27.6%