CVE-2026-20284

criticalpriority · track · 36EPSS 0.005 · 45 %ileNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.53% (45th) EPSS

CVSS 9.1 · critical

Is it mine?

97 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cisco_csaf · ncsc_nl

EPSS · scored 2026-10-27

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed3.1.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.1.0 p9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2 Patch 9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.2.0 p7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3 Patch 9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.3.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Workaround3.1.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p11cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.1.0 p9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2 Patch 9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.2.0 p7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 10cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 11cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 7cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 8cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3 Patch 9cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.3.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 4cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 5cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4 Patch 6cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.4.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 1cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 2cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5 Patch 3cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Workaround3.5.0cisco_csaf
CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities. CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hprimary · psirt@cisco.com USexploitability 2.3 · impact 6

v3.19.1criticalAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-641USCWE-943USCWE-943US

affected products (97)

Products and version ranges known to be affected.

Cisco 3.1.0all versionscisco_csafUS
Cisco 3.1.0 p1all versionscisco_csafUS
Cisco 3.1.0 p10all versionscisco_csafUS
Cisco 3.1.0 p11all versionscisco_csafUS
Cisco 3.1.0 p2all versionscisco_csafUS
Cisco 3.1.0 p3all versionscisco_csafUS
Cisco 3.1.0 p4all versionscisco_csafUS
Cisco 3.1.0 p5all versionscisco_csafUS
Cisco 3.1.0 p6all versionscisco_csafUS
Cisco 3.1.0 p7all versionscisco_csafUS
Cisco 3.1.0 p8all versionscisco_csafUS
Cisco 3.1.0 p9all versionscisco_csafUS
Cisco 3.2 Patch 10all versionscisco_csafUS
Cisco 3.2 Patch 8all versionscisco_csafUS
Cisco 3.2 Patch 9all versionscisco_csafUS
Cisco 3.2.0all versionscisco_csafUS
Cisco 3.2.0 p1all versionscisco_csafUS
Cisco 3.2.0 p2all versionscisco_csafUS
Cisco 3.2.0 p3all versionscisco_csafUS
Cisco 3.2.0 p4all versionscisco_csafUS

showing 20 of 97

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0382Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)NL2026-09-17csaf · ncsc_nlNL
Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC).
cisco-sa-ise-mult-vul-ymSsTLCcCisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities2026-09-16csaf · cisco_csafUS
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct SQL injections, modify data, or execute arbitrary commands on the underlying operating system on an affected device. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Note: For CVE-2026-20282 and CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the scores indicate. The reason is that it is easy to get to root from the achieved privilege level. Cisco has released software updates that address these vulnerabilities. There are workarounds that address one of these vulnerabilities. This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP"]. In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"].

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu cisco_csaf ncsc_nl NVD CVE.org MITRE

published 2026-09-16modified 2026-09-23

references (1) nvd

External citations — patches, advisories, analysis.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan