CVE-2026-76446: Cisco ISE XXE Vulnerability

CVE-2026-76446 Overview

CVE-2026-76446 is an XML External Entity (XXE) vulnerability in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). An authenticated, remote attacker with high privileges can read specific files on the underlying operating system of an affected device. The flaw stems from improper restriction of XML external entity references [CWE-611]. Exploitation requires sending a crafted XML request to the vulnerable API endpoint.

Critical Impact
A successful exploit allows an authenticated attacker to read files accessible to the underlying process, potentially exposing configuration data, credentials, or other sensitive artifacts stored on the ISE appliance.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco ISE Passive Identity Connector (ISE-PIC)
Specific affected versions are enumerated in the Cisco Security Advisory

Discovery Timeline

2026-09-16 - CVE-2026-76446 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76446

Vulnerability Analysis

The vulnerability resides in an API of Cisco ISE and ISE-PIC that parses XML input without properly restricting external entity references. When the affected XML parser processes attacker-supplied input, it resolves external entities declared in the document type definition (DTD). This behavior allows the parser to fetch content from local file paths and embed that content into the parsed document.

Exploitation requires an authenticated session with high privileges on the target device. The attack traverses the network stack against the API endpoint, so an attacker does not need local access. Impact is limited to confidentiality: the attacker can disclose file contents but cannot modify data or disrupt service through this flaw alone.

Cisco ISE stores policy, RADIUS/TACACS+ configuration, and identity-source connectors on disk. Files that the ISE process can read may include configuration state useful for lateral movement or subsequent privilege abuse within the identity infrastructure.

Root Cause

The root cause is [CWE-611]: Improper Restriction of XML External Entity Reference. The XML parser used by the affected API accepts and resolves external entities from crafted input. Secure parser configuration should disable DTD processing, external general entities, and external parameter entities before parsing untrusted XML.

Attack Vector

The attack vector is network-based against the vulnerable API on the ISE or ISE-PIC management interface. The attacker submits a crafted XML request containing an external entity declaration that references a local file URI. The parser dereferences the entity, reads the file, and returns the content within the API response or in an error message. Because privileges required are high, the attacker must already possess valid administrative credentials on the appliance.

No verified proof-of-concept code is publicly available. See the Cisco Security Advisory for vendor-authored technical details.

Detection Methods for CVE-2026-76446

Indicators of Compromise

API requests to Cisco ISE or ISE-PIC endpoints containing XML payloads with <!DOCTYPE> declarations or <!ENTITY> references
XML request bodies containing SYSTEM keywords paired with file:// URIs or absolute paths on the ISE filesystem
Anomalous administrative-session API activity that includes multi-line XML payloads outside normal automation patterns
ISE application or audit logs recording XML parsing errors referencing external entity resolution failures

Detection Strategies

Inspect HTTP request bodies destined for ISE management APIs for DTD declarations and external entity syntax
Correlate high-privilege administrative logins with subsequent XML-bearing API calls that are inconsistent with baseline usage
Alert on ISE API responses that return file-content-like data (for example, /etc/passwd fragments, certificate blocks) inline with API payloads

Monitoring Recommendations

Forward Cisco ISE administrative and API audit logs to a centralized SIEM or data lake for retention and correlation
Baseline normal API usage per administrator account and alert on deviations, particularly XML-heavy payloads
Monitor for outbound DNS or HTTP callbacks originating from ISE appliances, which can indicate blind XXE probing

How to Mitigate CVE-2026-76446

Immediate Actions Required

Review the Cisco Security Advisory and identify affected ISE and ISE-PIC versions in your environment
Apply the fixed software release published by Cisco for your deployment train
Audit administrative accounts on ISE and ISE-PIC, remove unused high-privilege accounts, and rotate credentials for accounts that remain
Restrict network reachability of the ISE management API to a dedicated administrative network segment

Patch Information

Cisco has published fixed software releases for Cisco ISE and Cisco ISE-PIC. Consult the Cisco Security Advisory for the specific fixed versions that address CVE-2026-76446 and follow Cisco's documented upgrade procedure for your deployment.

Workarounds

Cisco has not published a documented workaround for this issue; upgrading to a fixed release is the supported remediation
As a compensating control, enforce strict role-based access control (RBAC) on ISE administrative accounts and require multi-factor authentication for privileged access
Limit management-plane exposure using ACLs so only trusted jump hosts can reach ISE API ports

bash

# Example: restrict ISE management API access at the network edge
# (adjust interface, VLAN, and administrative subnet to your environment)
ip access-list extended ISE-MGMT-ACL
 permit tcp 10.10.20.0 0.0.0.255 host 10.20.30.40 eq 443
 deny   tcp any host 10.20.30.40 eq 443 log
 permit ip any any
!
interface Vlan30
 ip access-group ISE-MGMT-ACL in