CVE-2026-76431: Cisco ISE Path Traversal Vulnerability

CVE-2026-76431 Overview

CVE-2026-76431 is a path traversal vulnerability in the file management function of the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). An authenticated remote attacker with valid administrative credentials can delete arbitrary files and directories on the underlying operating system. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Successful exploitation enables an authenticated administrator to remove arbitrary files and directories on affected Cisco ISE and ISE-PIC deployments, potentially disrupting authentication services and network access control.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco ISE Passive Identity Connector (ISE-PIC)
Refer to the Cisco Security Advisory on ISE Multi-Traversal for specific fixed releases

Discovery Timeline

2026-09-16 - CVE-2026-76431 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76431

Vulnerability Analysis

The vulnerability resides in the file management function of the Cisco ISE and ISE-PIC web-based management interface. The interface accepts a user-supplied file path but fails to properly validate directory traversal character sequences before the request is processed. An authenticated attacker with administrative credentials can submit a crafted request containing traversal sequences such as ../ to reference files outside the intended directory. The application then performs the delete operation against the attacker-controlled path on the underlying operating system.

Because the attack targets deletion primitives rather than read or write, the impact centers on integrity and availability of the ISE appliance. Removal of configuration files, logs, or system binaries can disrupt authentication, authorization, and accounting (AAA) services that ISE provides across enterprise networks.

Root Cause

The root cause is improper input validation of pathname components, categorized as [CWE-22]. The file management handler normalizes or acts on the supplied path only after the request has been passed to the file operation, rather than canonicalizing and validating the path against an allowlist of permitted directories beforehand.

Attack Vector

Exploitation requires network access to the web-based management interface and valid administrative credentials, so the attack is constrained to actors who have already obtained privileged access. The attacker sends a crafted HTTP request to the vulnerable file management endpoint with a path parameter containing directory traversal sequences. No user interaction is required. Because no verified public exploit code is currently available, defenders should refer to the Cisco Security Advisory on ISE Multi-Traversal for authoritative technical detail.

Detection Methods for CVE-2026-76431

Indicators of Compromise

HTTP requests to the ISE administrative interface containing directory traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f)
Unexpected deletion of system files, configuration files, or log files on ISE or ISE-PIC appliances
Administrative session activity from unusual source addresses invoking file management endpoints

Detection Strategies

Inspect Cisco ISE administrative audit logs for file management operations invoked by administrator accounts, correlating with path arguments containing traversal characters
Deploy web application firewall or reverse proxy rules that flag traversal patterns in requests to the ISE management URL path
Monitor filesystem integrity on ISE nodes and alert on unexpected removal of files under system directories

Monitoring Recommendations

Forward ISE administrative and system logs to a centralized SIEM for correlation with authentication and change-management events
Baseline normal administrator behavior on the management interface and alert on deviations, including off-hours file operations
Review privileged account usage regularly to detect credential compromise, which is the prerequisite for exploiting this vulnerability

How to Mitigate CVE-2026-76431

Immediate Actions Required

Apply the fixed Cisco ISE and ISE-PIC releases identified in the Cisco Security Advisory on ISE Multi-Traversal
Restrict network access to the ISE web-based management interface to a dedicated management network or jump hosts
Rotate administrative credentials and enforce multi-factor authentication on all ISE administrator accounts

Patch Information

Cisco has published a security advisory covering this issue. Consult the Cisco Security Advisory on ISE Multi-Traversal to identify the fixed software trains for your deployment and follow Cisco's upgrade procedures for ISE and ISE-PIC nodes.

Workarounds

No vendor-documented workaround eliminates the flaw; treat access controls as compensating measures until patching
Limit the number of accounts with administrative privileges on ISE and audit their activity
Place the management interface behind an access control list that only permits trusted administrator source addresses