CVE-2026-76431: Authenticated Directory Traversal in Cisco ISE File Management Threatens NAC Availability in OT

Executive Summary

CVE-2026-76431 is a directory traversal flaw in the file management function of the web-based management interface of Cisco Identity Services Engine and Cisco ISE-PIC that lets an authenticated remote attacker delete arbitrary files and directories on the appliance. For OT environments that use ISE as the network access control enforcement point for plant and substation networks, destructive file operations against the policy server threaten the availability of authentication services that gate device connectivity.

Technical Exposure Breakdown

The root cause is improper validation of directory traversal character sequences in a user-supplied file path before the request is validated. The file path reaches the file management handler with traversal sequences intact, allowing an attacker to escape the intended working directory and reference files and directories elsewhere on the appliance filesystem. The exposed action is deletion, not read or write, which places this squarely in the integrity and availability column rather than confidentiality.

The precondition matters. Exploitation requires valid administrative credentials on the ISE management interface. This is not an unauthenticated remote takeover. The grounding data lists the affected products as Cisco Identity Services Engine and Cisco Identity Services Engine Passive Identity Connector across the vulnerable range 3.1.0 to 3.3.0. The assigned CVSS score is 4.9, consistent with a high-privilege, authenticated vector that yields a bounded destructive outcome rather than full code execution.

The threat model worth taking seriously here is credential compromise and insider abuse. Administrative accounts on NAC infrastructure are frequently shared, infrequently rotated, and bridged across IT and OT support teams. An attacker who phishes or reuses an ISE admin credential can convert that access into targeted deletion of configuration artifacts, logs, certificates, or other filesystem objects. Log deletion in particular is useful to an adversary covering activity on the policy server.

OT Impact and Compliance Risk

ISE is not a controller and does not directly drive a physical process. Its criticality in OT comes from its role as the gatekeeper for network access. If an attacker degrades or destabilizes the ISE appliance by deleting files that support policy evaluation, logging, or certificate handling, the downstream effect can be failed authentications, failed open or failed closed states depending on configuration, and loss of the audit trail that proves who connected to the OT network and when.

Under IEC 62443, this touches the integrity of the security zone enforcement function and the availability of the access control system itself. For NERC CIP registered entities, deletion of ISE audit and logging content directly implicates CIP-007 security event monitoring and CIP-010 configuration integrity, since the evidentiary record and baseline for the access control system can be altered by a single authenticated admin action. For pipeline operators under TSA SD-02C and water utilities under AWIA 2018, the loss of reliable access control logging undermines the ability to demonstrate who had network access during an incident window.

Compensating Controls

Do not treat the vendor patch as the only lever. Patch status in our grounding data is unknown, and ISE upgrades are maintenance events that OT change windows do not grant on demand.

• Isolate the management plane. Restrict the ISE web management interface to a dedicated administrative VLAN reachable only from a hardened jump host. The attacker needs reachability to the management interface plus credentials. Remove the reachability for all general IT and OT hosts.
• Harden and segregate admin credentials. Enforce unique named admin accounts, multifactor authentication on the management interface, and immediate rotation of any shared ISE admin credentials. Treat ISE admin accounts as tier-zero assets.
• Virtual patch at the reverse proxy. If ISE management is fronted by a proxy or WAF, reject requests whose file path parameters contain traversal sequences such as encoded and literal dot-dot-slash patterns before they reach the appliance.
• Suricata concept. On the span of the admin VLAN, alert on HTTP requests to the ISE management interface carrying path parameters with ../, ..%2f, or %2e%2e encodings. This is detection and triage support, not enforcement.
• Do not active scan the appliance. Aggressive probing of production NAC infrastructure can disrupt authentication services and the OT devices that depend on them. Validate version exposure from inventory and controlled queries, not intrusive scanning.

Monitor ISE filesystem integrity and audit log continuity as a leading indicator. A sudden gap in logging or missing configuration artifacts on the policy server should trigger investigation.

Intel by BreachSpider tracks CVE-2026-76431 and related access control infrastructure exposures for OT operators; follow BreachSpider for monitoring and detection updates.