Description

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-16T21:17:09.090Z",
  "pubdate": "2026-09-16T21:17:09.090Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the SXP REST API of Cisco ISE, stemming from inadequate sanitization of user-supplied inputs. This flaw permits an authenticated, remote attacker to execute arbitrary database queries against the underlying backend. Successful exploitation allows for unauthorized data exfiltration or modification, compromising the integrity and confidentiality of the system. In single-node configurations, the manipulation of database queries can lead to a Denial of Service (DoS) condition, rendering the ISE node unresponsive and preventing new network authentications. The attack vector is restricted to authenticated users with administrative privileges, requiring the SXP service to be enabled and at least one SXP connection to be active. Given the administrative requirement, the vulnerability poses a significant risk to organizations where internal privilege boundaries or administrative accounts might be compromised, directly impacting the availability and security posture of the network access control infrastructure.",
  "technicalDetails": "The vulnerability resides in the SXP REST API component of Cisco ISE, where improper input validation mechanisms fail to neutralize malicious SQL syntax within API request parameters. The SXP (Scalable Group Tag Exchange Protocol) service, when enabled and configured with at least one active connection, acts as the primary attack surface. An attacker leverages their administrative session to interact with the API, injecting crafted SQL payloads into the parameters of specific REST endpoints. These inputs are subsequently processed by the backend database layer without sufficient parameterization or escaping, allowing the attacker to break out of the intended query context.\nThe attack flow initiates when an authenticated administrator sends an HTTP request containing a maliciously crafted payload to the SXP REST API. Because the API logic does not correctly validate or bind these parameters before passing them to the database execution engine, the database interprets the injected strings as structural elements of the SQL command. This allows the attacker to manipulate the database logic, enabling the execution of arbitrary commands, including 'SELECT', 'UPDATE', or 'DELETE' operations on system tables. By modifying critical data, an attacker can alter network policies or extract sensitive operational configuration data.\nThe impact on system stability is particularly severe in single-node environments. By crafting specific SQL payloads that trigger resource-intensive database operations or cause contention on critical system tables, the attacker can force the ISE node to hang or crash. This results in a DoS state, effectively halting the AAA (Authentication, Authorization, and Accounting) services provided by the node. Consequently, all endpoints attempting to authenticate to the network are denied access until the affected node is manually recovered. The requirement for valid administrative credentials indicates that this vulnerability is primarily a privilege escalation or persistence risk for an attacker who has already breached the administrative management plane of the Cisco ISE device. The vulnerability highlights a failure in the input validation lifecycle of the REST interface, specifically where high-privilege API calls interact with the persistent data layer."
}