A critical command injection vulnerability in Cisco ISE and ISE-PIC allows authenticated administrative attackers to execute arbitrary system commands and potentially gain root privileges.

This vulnerability (CWE-77) results from insufficient validation of user-supplied input, allowing an authenticated attacker with administrative credentials to execute arbitrary commands, escalate to root, or trigger a denial-of-service condition.

Exploitation of this vulnerability allows an attacker to gain full control over identity services, which are central to network security. The potential for total system compromise and the interruption of critical network authentication services justifies the 9.9 CVSS severity rating.

Immediate Action: Update both Cisco ISE and Cisco ISE Passive Identity Connector to the latest versions recommended by the vendor.

Proactive Monitoring: Monitor administrative login activity and inspect system logs for unusual command execution patterns or abnormal process behavior on ISE nodes.

Compensating Controls: Enforce strict access control lists (ACLs) for the management interface and ensure that administrative credentials are managed securely to prevent potential abuse by malicious insiders or compromised accounts.

Public Exploit Available: Unknown

Security teams must prioritize patching these systems as they are fundamental to network authentication. Ensure that all affected nodes, including Passive Identity Connector instances, are updated immediately to mitigate the risk of command injection and root-level exploitation.