CVE-2017-6747 Auth bypass in Cisco Identity Services Engine
An unauthenticated remote attacker can bypass local authentication to gain Super Admin privileges on the Cisco ISE Admin portal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6747?
CVE-2017-6747 is a critical authentication bypass vulnerability in Cisco Identity Services Engine, published on 7 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An exploit could allow the attacker to have Super Admin privileges for the ISE Admin portal. This vulnerability does not affect endpoints authenticating to the ISE. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance running Release 1.3, 1.4, 2.0.0, 2.0.1, or 2.1.0. Release 2.2.x is not affected. Cisco Bug IDs: CSCvb10995.
Weakness: CWE-287
Which versions are affected by CVE-2017-6747?
It affects 1 product.
Products include Cisco Identity Services Engine.
How do I fix CVE-2017-6747?
No fix has been published for CVE-2017-6747 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-6747 being exploited?
There is no known exploitation of CVE-2017-6747 in the wild and no public exploit code.
Other vulnerabilities in Cisco Identity Services Engine
- CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs
- CVE-2025-20337 Cisco Identity Services Engine Injection
- CVE-2025-20281 Cisco Identity Services Engine Injection
- CVE-2026-20130 Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
- CVE-2026-20192 Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
Sources
Also known as GHSA-4742-8cjm-26f3.