CVE-2026-76434: Cisco ISE Information Disclosure Vulnerability

CVE-2026-76434 Overview

CVE-2026-76434 is a path traversal vulnerability in the certificate import functionality of the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). An authenticated, remote attacker with valid administrative credentials can send a crafted request to read arbitrary files from the affected device. The affected feature does not sufficiently validate user-supplied input, enabling access to files outside the intended directory. Successful exploitation can expose sensitive information stored on the appliance, including configuration data and credential material. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
An authenticated administrator can read arbitrary files from Cisco ISE or ISE-PIC appliances, potentially exposing sensitive configuration and credential data.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco Identity Services Engine Passive Identity Connector (ISE-PIC)
Web-based management interface component

Discovery Timeline

2026-09-16 - CVE-2026-76434 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Vendor advisory - Cisco Security Advisory on Multi-Traversal

Technical Details for CVE-2026-76434

Vulnerability Analysis

The vulnerability resides in the certificate import feature exposed by the Cisco ISE and ISE-PIC web-based management interface. The affected handler accepts user-supplied input associated with certificate upload operations without sufficient validation. An attacker who possesses valid administrative credentials can supply crafted path values that escape the intended import directory. The application then reads files from arbitrary locations on the underlying appliance filesystem and returns their contents to the attacker.

Because Cisco ISE stores authentication, authorization, and accounting (AAA) configuration, RADIUS shared secrets, and integration credentials, file disclosure can reveal information that facilitates lateral movement into network infrastructure. Exploitation does not affect the integrity or availability of the appliance, but it does compromise confidentiality of on-disk data.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The certificate import routine does not canonicalize or restrict user-supplied path components. As a result, traversal sequences resolve outside the certificate staging directory and reach arbitrary file paths on the appliance.

Attack Vector

The attack vector is the network-exposed web-based management interface. The attacker must first authenticate as an administrator. Once authenticated, the attacker submits a crafted certificate import request whose input parameters contain path traversal sequences. The server processes the request, reads the referenced file, and returns its contents in the response. No user interaction is required.

Refer to the Cisco Security Advisory on Multi-Traversal for vendor-supplied technical details.

Detection Methods for CVE-2026-76434

Indicators of Compromise

Certificate import requests to the ISE administrative interface containing traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute paths.
Administrative sessions accessing the certificate import endpoint from unusual source addresses or outside normal change windows.
Web server or application logs showing successful file reads correlated with certificate import operations that did not result in a stored certificate.

Detection Strategies

Inspect ISE application and audit logs for certificate import activity and correlate with administrator account activity.
Deploy web application firewall rules that flag path traversal payloads in requests to the ISE administrative interface.
Alert on administrator logins that immediately invoke certificate import functions without corresponding certificate provisioning workflow tickets.

Monitoring Recommendations

Forward ISE administrative and audit logs to a centralized SIEM for retention and correlation.
Monitor administrative credential use for anomalous source IPs, times, and access patterns.
Track outbound data flows from ISE appliances that could indicate exfiltration of harvested files.

How to Mitigate CVE-2026-76434

Immediate Actions Required

Restrict network access to the Cisco ISE and ISE-PIC administrative interface to trusted management networks only.
Rotate administrative credentials and enforce multi-factor authentication for all ISE administrators.
Audit recent certificate import activity for unexpected requests or unfamiliar administrator accounts.
Review the Cisco Security Advisory on Multi-Traversal and apply fixed software versions when available.

Patch Information

Cisco has published a security advisory for this issue. Consult the Cisco Security Advisory on Multi-Traversal for the list of fixed releases and upgrade guidance for Cisco ISE and ISE-PIC.

Workarounds

Limit administrative access to a dedicated out-of-band management network.
Apply role-based access control so that only a minimal number of accounts hold the privileges required to reach the certificate import feature.
Increase logging verbosity on administrative activity and forward logs off-device to preserve evidence.

bash

# Configuration example: restrict management access using an access list
# Replace with the addresses of your authorized management hosts
configure terminal
ip access-list standard ISE-MGMT-ACL
 permit host 10.10.10.5
 permit host 10.10.10.6
 deny any log
end