SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76424

HIGH(7.2)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score28/100 — MITTEL
  • CVSS 7.2 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "REST API" and InitiatingProcessCommandLine contains "upload" and Initi InitiatingProcessCommandLine contains "file" and InitiatingProcessCommandLine contains "path"
| where InitiatingProcessParentFileName =~ "java" or InitiatingProcessParentFileName =~ "tomcat" // Assuming ISE REST API runs on Java/Tomcat
| project Timestamp, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessMD5, InitiatingProcessSHA1, InitiatingProcessSHA256

Splunk SPL

index=* (sourcetype=cisco:ise OR sourcetype=ise:rest:api) ("REST API" AND upload AND file AND path)
| search (process="java" OR process="tomcat")
| table _time, host, process, command, user, dest_ip, src_ip

Sigma

title: Cisco ISE Arbitrary File Access via REST API
id: 76424-cisco-ise-arbitrary-file-access
status: experimental
description: Detects potential exploitation of CVE-2026-76424 in Cisco ISE REST API.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains_all:
      - 'REST API'
      - 'upload'
      - 'file'
      - 'path'
    ParentImage|endswith:
      - '\java'
      - '\tomcat'
  condition: selection
fields:
  - CommandLine
  - ParentImage
tags:
  - attack.initial_access
  - attack.t1136
  - cve.2026.76424

Elastic ES|QL

from process where process.command_line : "REST API" and process.command_line : "upload" and process.command_line : "file" and process.command_line : "path" and (process.parent.name : "java" or process.parent.name : "tomcat") | select @timestamp, host.name, process.command_line, process.name, process.parent.name, process.pid, process.hash.md5, process.hash.sha1, process.hash.sha256

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen