A crafted HTTP request runs commands as root on unpatched Cisco ISE nodes

The path is three steps, all of them before authentication. A crafted HTTP request arrives at the ISE or ISE-PIC management API over the network. The request bypasses web management interface authentication. Internal administrative functions are then abused to execute commands with root privileges on the appliance ^[6].

Cisco's advisory and the CISA KEV entry carry the same date, 2026-09-16 ^[22]. Confirmation of exploitation in the wild arrived with the disclosure ^[4].

The advisory says vulnerable releases are affected regardless of which features are enabled ^[3]. The preconditions are network reach to the management API and a missing patch ^[12]. The resolved state is the patch applied completely across all nodes ^[13]. A deployment part-way through a rolling upgrade still has a node that answers the crafted request ^[23].

Environments directly exposed to the internet are in scope, and so are attackers positioned to reach the interface from internal networks, VPNs, or operations management segments ^[11]. Infrastructure ACLs that restrict permitted source addresses to trusted management networks reduce exposure, but they do not fix the vulnerability and do not help against an attacker who already has access through an allowed source ^[14].

Evidence is where this gets expensive. In the ISE web server access log, the clues are suspicious usernames and unexpected management API calls, alongside unexpected processes running with root privileges ^[10]. Also on the list: management operations with no matching login record for a legitimate ISE admin account, unnatural gaps in the authentication logs, and unauthorized creation of new administrator accounts ^[20]. An attacker who clears local log files removes most of that ^[7]. Cisco's guidance is to cross-reference logs inside ISE against external network device records ^[8], and the recommendation is to preserve firewall, reverse proxy and NetFlow records ^[18]. Because this is a dedicated appliance, standard EDR agents may not be deployable ^[16].

Impact runs past the appliance: modification of network access control and authentication infrastructure settings, leakage of stored secrets, and loss of overall system trust ^[15]. The follow-up is a review of configuration change history in systems integrated with ISE, including server certificates, RADIUS authentication, identity providers and MDM, plus a check for exposed shared secrets ^[17].

Most of the detection steps in the write-up are labelled inferences rather than Cisco statements, and one of them sets the limit on hunting: public information alone does not establish a pattern that uniquely identifies all attack traffic ^[19]. Since the attack requires no interaction from ordinary users, obvious anomalies may not appear on their screens, and the absence of screen anomalies does not prove a lack of compromise ^[9]. This one is a direct attack on the web management API, and email vector involvement has not been confirmed ^[21].