Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-76433

medium

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected…

Vendor / product: Cisco — identity services engine

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.

CVSS
5.3
5.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity source: NVD CVSS v3.1 (psirt@cisco.com)
Timeline (UTC)
Published: 2026-09-16 21:17
Modified: 2026-09-28 13:16
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:54 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

cisco / identity_services_engine ≥3.1.0 <3.3.0, 3.3.0, 3.4.0, 3.5.0
cisco / identity_services_engine_passive_identity_connector ≥3.1.0 <3.3.0, 3.3.0, 3.4.0

Weakness classification (CWE)

CWE-22

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:54 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-20293CVE-2026-20182CVE-2026-20349CVE-2026-20157CVE-2026-20156