What’s Vulnerable › Vulnerabilities
CVE-2026-20306: Cisco Identity Services Engine Command Injection Vulnerability
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-78
Description
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Affected products
- Cisco ISE Passive Identity Connector: 3.4.0
- Cisco Identity Services Engine: 3.4 Patch 4, 3.4 Patch 5, 3.5 Patch 3, 3.4 Patch 6
In the news
References
Get alerted when CVE-2026-20306 or the next vulnerability affects your stack