CVE-2026-76431 Cisco Identity Services Engine Arbitrary File Deletion Vulnerability
An authenticated attacker can delete arbitrary files on Cisco ISE via path traversal in the web management interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76431?
CVE-2026-76431 is a medium-severity path traversal vulnerability in Cisco Identity Services Engine, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of directory traversal character sequences in a user-supplied file path before the request is validated. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to delete arbitrary files and directories on the underlying operating system of the affected device.
Weakness: CWE-22
Which versions are affected by CVE-2026-76431?
It affects 2 products.
Products include Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector.
How do I fix CVE-2026-76431?
No fix has been published for CVE-2026-76431 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-76431 being exploited?
There is no known exploitation of CVE-2026-76431 in the wild and no public exploit code.
Other vulnerabilities in Cisco Identity Services Engine
- CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs
- CVE-2025-20337 Cisco Identity Services Engine Injection
- CVE-2025-20281 Cisco Identity Services Engine Injection
- CVE-2026-20130 Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
- CVE-2026-20192 Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
Sources
Also known as GHSA-2428-c4mc-4v7f.