CVE-2026-20300

highPriorität · verfolgen · 28EPSS 0.004 · 32. PerzentilRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.38% (32nd) EPSS
CVSS 7.1 · high
Is it mine?
92 products
Prüfe deine Angriffsfläche
Who says so?
2 sources
fstec_bdu · cisco_csaf

EPSS · bewertet 2026-10-27

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read or modify data in the underlying database.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.5–7.1

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Nprimary · psirt@cisco.com USAusnutzbarkeit 2.8 · Auswirkung 4.2
v3.17.1highAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Nsecondary · Cisco PSIRT US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-89USCWE-89US
05

betroffene Produkte (92)

Betroffene Produkte und Versionsbereiche.

20 von 92 angezeigt
06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • cisco-sa-ise-sql-inj-3QTKR947Cisco Identity Services Engine SQL Injection Vulnerabilities2026-09-16csaf · cisco_csafUS

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow a remote attacker to conduct SQL injection attacks on an affected device. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP"]. In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"].

07

auch bekannt als (2)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

fstec_bducisco_csafNVDCVE.orgMITRE
veröffentlicht 2026-09-16geändert 2026-09-23
09

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan