CVE-2026-20282

mediumpriority · track · 20EPSS 0.006 · 48 %ileNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.60% (48th) EPSS

CVSS 4.9 · medium

Is it mine?

51 products

Check your exposure

Who says so?

2 sources

cisco_csaf · ncsc_nl

EPSS · scored 2026-10-27

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain write access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed3.1.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p12cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Workaround3.1.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p11cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p12cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 11cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 11cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technical severity, 0–10. One row per scoring source.

4.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Nprimary · psirt@cisco.com USexploitability 1.2 · impact 3.6

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Nsecondary · NCSC-NL NL

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Nsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-641USCWE-641US

affected products (51)

Products and version ranges known to be affected.

Cisco 3.1.0all versionscisco_csafUS
Cisco 3.1.0 p1all versionscisco_csafUS
Cisco 3.1.0 p10all versionscisco_csafUS
Cisco 3.1.0 p11all versionscisco_csafUS
Cisco 3.1.0 p12all versionscisco_csafUS
Cisco 3.1.0 p2all versionscisco_csafUS
Cisco 3.1.0 p3all versionscisco_csafUS
Cisco 3.1.0 p4all versionscisco_csafUS
Cisco 3.1.0 p5all versionscisco_csafUS
Cisco 3.1.0 p6all versionscisco_csafUS
Cisco 3.1.0 p7all versionscisco_csafUS
Cisco 3.1.0 p8all versionscisco_csafUS
Cisco 3.1.0 p9all versionscisco_csafUS
Cisco 3.2 Patch 10all versionscisco_csafUS
Cisco 3.2 Patch 11all versionscisco_csafUS
Cisco 3.2 Patch 8all versionscisco_csafUS
Cisco 3.2 Patch 9all versionscisco_csafUS
Cisco 3.2.0all versionscisco_csafUS
Cisco 3.2.0 p1all versionscisco_csafUS
Cisco 3.2.0 p2all versionscisco_csafUS

showing 20 of 51

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0382Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)NL2026-09-17csaf · ncsc_nlNL
Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC).
cisco-sa-ise-mult-vul-ymSsTLCcCisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities2026-09-16csaf · cisco_csafUS
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct SQL injections, modify data, or execute arbitrary commands on the underlying operating system on an affected device. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Note: For CVE-2026-20282 and CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the scores indicate. The reason is that it is easy to get to root from the achieved privilege level. Cisco has released software updates that address these vulnerabilities. There are workarounds that address one of these vulnerabilities. This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP"]. In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"].

sources

Which sources assert this record, and when.

cisco_csaf ncsc_nl NVD CVE.org MITRE

published 2026-09-16modified 2026-09-22

references (1) nvd

External citations — patches, advisories, analysis.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan