A critical command injection vulnerability in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to achieve remote code execution as root.

The vulnerability is caused by insufficient input validation (CWE-22), allowing an attacker with at least Read Only Admin credentials to send crafted HTTP requests that result in arbitrary command execution on the underlying OS.

An attacker gaining root access to the Cisco ISE device can compromise the entire network authentication infrastructure, leading to total loss of confidentiality, integrity, and availability. With a CVSS score of 9.9, this vulnerability represents an existential risk to the security of the network perimeter and internal access controls.

Immediate Action: Update Cisco Identity Services Engine (ISE) to the latest patched version specified in the vendor security advisory.

Proactive Monitoring: Review administrative audit logs for suspicious HTTP requests or unexpected command execution attempts on the ISE appliance.

Compensating Controls: Restrict administrative access to the ISE management interface to trusted internal IP addresses only, and implement strict least-privilege policies to minimize the number of users with Read Only Admin or higher roles.

Public Exploit Available: Unknown

Given the potential for complete system takeover and denial of service, administrators must treat this vulnerability with the highest urgency. Patching should be conducted immediately, and administrative access to the ISE console should be strictly limited until updates are applied.