{"api_version":"1","generated_at":"2026-10-01T14:58:41+00:00","cve":"CVE-2026-76433","urls":{"html":"https://cve.report/CVE-2026-76433","api":"https://cve.report/api/cve/CVE-2026-76433.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76433","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76433"},"summary":{"title":"Cisco Identity Services Engine Information Disclosure Vulnerability","description":"A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.","state":"PUBLISHED","assigner":"cisco","published_at":"2026-09-16 21:17:15","updated_at":"2026-09-28 13:16:49"},"problem_types":["CWE-22","CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSSV3_1","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn","name":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn","refsource":"psirt@cisco.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76433","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76433","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 11","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p72","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p11","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco ISE Passive Identity Connector","version":"affected 3.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco ISE Passive Identity Connector","version":"affected 3.1.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco ISE Passive Identity Connector","version":"affected 3.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco ISE Passive Identity Connector","version":"affected 3.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco ISE Passive Identity Connector","version":"affected 3.5.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"The Cisco PSIRT is aware that a public announcement is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch10","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch11","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch7","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch8","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.3.0","cpe7":"patch9","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.4.0","cpe7":"patch6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.5.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.5.0","cpe7":"patch1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.5.0","cpe7":"patch2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"3.5.0","cpe7":"patch3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch10","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch11","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch7","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch8","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.3.0","cpe7":"patch9","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"76433","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_passive_identity_connector","cpe6":"3.4.0","cpe7":"patch6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"76433","cve":"CVE-2026-76433","epss":"0.012660000","percentile":"0.685770000","score_date":"2026-09-29","updated_at":"2026-09-30 00:11:22"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-76433","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T14:07:58.643636Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-17T14:08:08.573Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco Identity Services Engine Software","vendor":"Cisco","versions":[{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.1.0 p1"},{"status":"affected","version":"3.1.0 p3"},{"status":"affected","version":"3.1.0 p2"},{"status":"affected","version":"3.2.0"},{"status":"affected","version":"3.1.0 p4"},{"status":"affected","version":"3.1.0 p5"},{"status":"affected","version":"3.2.0 p1"},{"status":"affected","version":"3.1.0 p6"},{"status":"affected","version":"3.2.0 p2"},{"status":"affected","version":"3.1.0 p7"},{"status":"affected","version":"3.3.0"},{"status":"affected","version":"3.2.0 p3"},{"status":"affected","version":"3.2.0 p4"},{"status":"affected","version":"3.1.0 p8"},{"status":"affected","version":"3.2.0 p5"},{"status":"affected","version":"3.2.0 p6"},{"status":"affected","version":"3.1.0 p9"},{"status":"affected","version":"3.3 Patch 2"},{"status":"affected","version":"3.3 Patch 1"},{"status":"affected","version":"3.3 Patch 3"},{"status":"affected","version":"3.4.0"},{"status":"affected","version":"3.2.0 p7"},{"status":"affected","version":"3.3 Patch 4"},{"status":"affected","version":"3.4 Patch 1"},{"status":"affected","version":"3.1.0 p10"},{"status":"affected","version":"3.3 Patch 5"},{"status":"affected","version":"3.3 Patch 6"},{"status":"affected","version":"3.4 Patch 2"},{"status":"affected","version":"3.3 Patch 7"},{"status":"affected","version":"3.4 Patch 3"},{"status":"affected","version":"3.5.0"},{"status":"affected","version":"3.4 Patch 4"},{"status":"affected","version":"3.3 Patch 8"},{"status":"affected","version":"3.2 Patch 8"},{"status":"affected","version":"3.5 Patch 1"},{"status":"affected","version":"3.3 Patch 9"},{"status":"affected","version":"3.2 Patch 9"},{"status":"affected","version":"3.4 Patch 5"},{"status":"affected","version":"3.5 Patch 3"},{"status":"affected","version":"3.5 Patch 2"},{"status":"affected","version":"3.3 Patch 10"},{"status":"affected","version":"3.3 Patch 11"},{"status":"affected","version":"3.4 Patch 6"},{"status":"affected","version":"3.2 Patch 10"},{"status":"affected","version":"3.1.0 p72"},{"status":"affected","version":"3.1.0 p11"},{"status":"affected","version":"3.4 Patch 7"}]},{"defaultStatus":"unknown","product":"Cisco ISE Passive Identity Connector","vendor":"Cisco","versions":[{"status":"affected","version":"3.2.0"},{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.3.0"},{"status":"affected","version":"3.4.0"},{"status":"affected","version":"3.5.0"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is aware that a public announcement is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-09-16T20:17:48.429Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-ise-multi-traversal-WDTgYCdn","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn"}],"source":{"advisory":"cisco-sa-ise-multi-traversal-WDTgYCdn","defects":["CSCwu73783"],"discovery":"EXTERNAL"},"title":"Cisco Identity Services Engine Information Disclosure Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-76433","datePublished":"2026-09-16T20:17:48.429Z","dateReserved":"2026-08-19T12:02:03.634Z","dateUpdated":"2026-09-17T14:08:08.573Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 21:17:15","lastModifiedDate":"2026-09-28 13:16:49","problem_types":["CWE-22","CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-17T14:07:58.643636Z","id":"CVE-2026-76433","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.3.0","matchCriteriaId":"FAD3927B-E71E-4497-8928-11FFA9965479"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*","matchCriteriaId":"F1B9C2C1-59A4-49A0-9B74-83CCB063E55D"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*","matchCriteriaId":"DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch10:*:*:*:*:*:*","matchCriteriaId":"43F3A55D-D4FC-4D93-9513-94B64B21A2B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch11:*:*:*:*:*:*","matchCriteriaId":"F0F60A00-E952-400A-B553-BE96E7FF746F"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*","matchCriteriaId":"E6C94CC4-CC08-4DAF-A606-FDAFC92720A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*","matchCriteriaId":"BB069EA3-7B8C-42B5-8035-2EE5ED3F56E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*","matchCriteriaId":"FF8B81A6-BF44-4E5F-B167-39F61DDCA026"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*","matchCriteriaId":"56E0F0EC-3E66-4866-89F5-89B331F3F517"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*","matchCriteriaId":"2E3E8937-2859-4A2A-91C0-05F674EF0466"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:*","matchCriteriaId":"D4B14684-EB9E-405B-85FA-B62E57CB292C"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch8:*:*:*:*:*:*","matchCriteriaId":"22B752D1-9E8F-4FB7-8EEB-F9234492372B"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch9:*:*:*:*:*:*","matchCriteriaId":"85A1CC7D-FE54-4AC0-B98F-972C4B1F3189"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*","matchCriteriaId":"D23905E0-E525-49B1-8E5F-4EB42D186768"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*","matchCriteriaId":"74509498-38EF-4345-9583-CEF5C26CA1D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:*","matchCriteriaId":"CD05FF93-7B8C-4283-9DB7-E03FE98FAADF"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:*","matchCriteriaId":"0F9B6A8E-E773-44A3-9266-878F0C58EB41"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch4:*:*:*:*:*:*","matchCriteriaId":"D3727619-E0CA-4CA9-BE35-0C732BCF1741"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch5:*:*:*:*:*:*","matchCriteriaId":"2CFB7565-3930-409C-B5DB-CE77E6ED7C42"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch6:*:*:*:*:*:*","matchCriteriaId":"A388D916-D6A1-4D3A-A48A-A150F387B755"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.5.0:-:*:*:*:*:*:*","matchCriteriaId":"2610FD35-BC4B-41B7-9C92-E6E5264FEE54"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch1:*:*:*:*:*:*","matchCriteriaId":"3FEE4377-B238-4442-9892-28CECFB2319E"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch2:*:*:*:*:*:*","matchCriteriaId":"6598563B-7E32-43FB-96A7-88C53E4CE226"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch3:*:*:*:*:*:*","matchCriteriaId":"719C8E82-269D-4F21-B2B4-4CD3033A17F9"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.3.0","matchCriteriaId":"B92D6093-92D7-4A0A-8954-DB99BC05E90D"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*","matchCriteriaId":"3CA3315D-8A45-43F4-A0F0-094D325F285B"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*","matchCriteriaId":"B3736136-9FD8-4B12-B119-EA15201224D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch10:*:*:*:*:*:*","matchCriteriaId":"FB15AE6D-F4EF-40AD-A88E-D22612AEF2A4"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch11:*:*:*:*:*:*","matchCriteriaId":"25B8E5EB-393A-40E8-9A0D-465ECCC2A4B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*","matchCriteriaId":"654ED77E-22D3-4E76-9E6D-B1581F5982F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*","matchCriteriaId":"A0648EE9-F042-479F-9AAB-C6B5DBC46511"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*","matchCriteriaId":"83F3BA58-4F38-41C8-956F-38A2F44EECE4"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*","matchCriteriaId":"6C30FA1D-91E2-48C5-B181-A88FDF668278"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*","matchCriteriaId":"768215B1-80B7-40FF-8772-BA4C0B3913F5"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch7:*:*:*:*:*:*","matchCriteriaId":"40239DA8-43B6-466B-85B0-6D644D7027D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch8:*:*:*:*:*:*","matchCriteriaId":"9118B7ED-E678-47C3-9D17-F522D9362B2F"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch9:*:*:*:*:*:*","matchCriteriaId":"C2ED3257-CB9D-4FD5-A482-3648CF292128"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*","matchCriteriaId":"CC0525FD-C4D7-4B48-BF35-1791391AB148"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*","matchCriteriaId":"68C96F6B-51EE-4D03-9598-CBFD16DA22EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch2:*:*:*:*:*:*","matchCriteriaId":"62F25185-D19E-4EC5-8A68-7AB669B76E90"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch3:*:*:*:*:*:*","matchCriteriaId":"C457D2EC-FB63-49B7-A90E-CE67ED763BAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch4:*:*:*:*:*:*","matchCriteriaId":"6566330F-A048-44A1-9821-7A5844C82CEC"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch5:*:*:*:*:*:*","matchCriteriaId":"1154F196-2CB3-4AC2-BE00-11A8942EA999"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch6:*:*:*:*:*:*","matchCriteriaId":"7E30ECF6-5B1D-4280-AA02-123153E68F28"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76433","Ordinal":"1","Title":"Cisco Identity Services Engine Information Disclosure Vulnerabil","CVE":"CVE-2026-76433","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76433","Ordinal":"1","NoteData":"A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.","Type":"Description","Title":"Cisco Identity Services Engine Information Disclosure Vulnerabil"}]}}}