SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76425

HIGH(7.6)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Risk Signal Score29/100 — MITTEL
  • CVSS 7.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "sql" and InitiatingProcessCommandLine contains "select" and InitiatingProcessCommandLine contains "from"
| where FileName contains "java" or FileName contains "python" or FileName contains "php" // Common web application runtimes
| where InitiatingProcessParentFileName contains "httpd" or InitiatingProcessParentFileName contains "nginx" or InitiatingProcessParentFileName contains "tomcat" // Common web servers/app servers
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine

Splunk SPL

(sourcetype=cisco:ise OR sourcetype=webserver) (sql OR database) (select OR from) (java OR python OR php) (httpd OR nginx OR tomcat)
| table _time, host, process, command, parent_process, parent_command

Sigma

title: Cisco ISE SQL Injection Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential SQL injection attempts against Cisco ISE APIs.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
    Image|endswith:
      - '\java.exe'
      - '\python.exe'
      - '\php.exe'
    CommandLine|contains:
      - 'sql'
      - 'select'
      - 'from'
  condition: selection

Elastic ES|QL

from process where process.parent.executable in ("httpd.exe", "nginx.exe", "tomcat.exe") and process.executable in ("java.exe", "python.exe", "php.exe") and process.command_line : ("*sql*", "*select*", "*from*") | select @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen