Cisco ISE Unauthenticated Remote Code Execution Vulnerability

The Cisco Identity Services Engine (ISE) is a network access control and identity management system used by large enterprises. This vulnerability allows an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root, potentially leading to unauthorized access to sensitive data.

You're affected if you use A vulnerability. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to an enhanced fixed release of Cisco ISE as follows:

• If Cisco ISE is running Release 3.4 Patch 2, no further action is necessary.
• If Cisco ISE is running Release 3.3 Patch 6, upgrade to Release 3.3 Patch 7 or Release 3.4 Patch 2.
• If Cisco ISE has either hot patch ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz or ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz installed, upgrade to Release 3.3 Patch 7 or Release 3.4 Patch 2.

Immediate mitigations:

• Restrict network access to your Cisco ISE instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• Vendor Advisory
• www.cisa.gov