CVE-2018-0091: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow a...

Security readout for executives and security teams

Cisco ISE's web management interface could let a remote unauthenticated attacker run script in a user's browser if they convince that user to click a malicious link. Successful exploitation could expose sensitive browser-based information or abuse the trusted management context. The bundle provides no CVSS score, fixed version details, or evidence of active exploitation. Exposure is limited to organizations running Cisco Identity Services Engine with users accessing its web-based management interface. Risk increases where management access is reachable from broad internal networks or where administrators browse email or external content from the same browser context. Treat this as a targeted administrative-console risk, not a broad internet worm risk. Prioritize if Cisco ISE is business-critical, reachable by many internal users, or managed from general-purpose workstations. Confirm vendor remediation status before scheduling change work. Mitigation focus: Check Cisco advisory cisco-sa-20180117-ise for affected and fixed ISE releases.; Apply Cisco-provided fixed software or workaround if listed in vendor guidance.; Restrict ISE management interface access to trusted administrative networks..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.