**Name of the Vulnerable Software and Affected Versions:**

Cisco Identity Services Engine (ISE) and Cisco ISE-Passive Identity Connector (ISE-PIC) versions 3.3 and 3.4

**Description:**

A critical vulnerability exists in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input. This allows an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. Exploitation can be achieved by submitting a crafted API request.

**Recommendations:**

Upgrade to ISE version 3.3 Patch 7 or ISE version 3.4 Patch 2.