What’s Vulnerable › Vulnerabilities
CVE-2026-76433: Cisco Identity Services Engine Information Disclosure Vulnerability
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-28
- Weakness: CWE-22
Description
A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.
Affected products
- Cisco Identity Services Engine: from 3.1.0 before 3.3.0; 3.3.0, 3.3.0-patch1, 3.3.0-patch10, 3.3.0-patch11, 3.3.0-patch2, 3.3.0-patch3 (+17) — fixed in 3.3.0
- Cisco Identity Services Engine Passive Identity Connector: from 3.1.0 before 3.3.0; 3.3.0, 3.3.0-patch1, 3.3.0-patch10, 3.3.0-patch11, 3.3.0-patch2, 3.3.0-patch3 (+13) — fixed in 3.3.0
How to fix
Upgrade to a fixed version: Cisco Identity Services Engine 3.3.0; Cisco Identity Services Engine Passive Identity Connector 3.3.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76433 or the next vulnerability affects your stack