A critical command injection vulnerability in Cisco ISE allows an authenticated attacker to achieve full root-level compromise and potentially trigger a denial-of-service condition.

This is a command injection vulnerability (CWE-77) caused by insufficient input validation of HTTP requests. An attacker possessing Read-Only Admin credentials can exploit this to execute arbitrary commands on the underlying operating system, eventually escalating privileges to root.

With a CVSS score of 9.9, this vulnerability is extremely severe. An attacker who has gained low-level administrative access can pivot to full system control, potentially compromising the entire network identity and access management infrastructure. Furthermore, the risk of a DoS condition could lead to widespread network authentication failures across the organization.

Immediate Action: Update Cisco Identity Services Engine to the latest patched version specified in the vendor security advisory (cisco-sa-ise-rce-4fverepv).

Proactive Monitoring: Review access logs for suspicious HTTP requests targeting ISE administrative interfaces and monitor system integrity for unauthorized process execution.

Compensating Controls: Restrict administrative access to the ISE management interface to a limited set of known-good IP addresses and enforce multi-factor authentication for all administrative accounts.

Public Exploit Available: Unknown

Due to the high CVSS score and the critical role of Cisco ISE in network security, this update should be applied during the next maintenance window. Ensure that all administrative access is audited and restricted to authorized personnel to prevent initial exploitation.