CVE-2026-20306

criticalpriority · track · 37EPSS 0.016 · 75 %ileNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.55% (75th) EPSS

CVSS 9.1 · critical

Is it mine?

58 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cisco_csaf · ncsc_nl

EPSS · scored 2026-10-27

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed3.4 Patch 4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4 Patch 6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.4.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Fixed3.5 Patch 3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hprimary · psirt@cisco.com USexploitability 2.3 · impact 6

v3.19.1criticalAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78USCWE-78US

affected products (58)

Products and version ranges known to be affected.

Cisco 3.4 Patch 4all versionscisco_csafUS
Cisco 3.4 Patch 5all versionscisco_csafUS
Cisco 3.4 Patch 6all versionscisco_csafUS
Cisco 3.4.0all versionscisco_csafUS
Cisco 3.5 Patch 3all versionscisco_csafUS
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 2fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.2 Patch 9fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.1.0 p9fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.2 Patch 8fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 7fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.2.0 p7fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.2 Patch 10fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 5fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 1fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 4fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 3fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.1.0 p11fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.3 Patch 6fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.1.0 p10fstec_bduRU
Cisco Systems, Inc. Cisco Identity Services Engine≤ 3.1.0 p8fstec_bduRU

showing 20 of 58

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0382Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)NL2026-09-17csaf · ncsc_nlNL
Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC).
cisco-sa-ise-cmd-inj-e2CuZCYZCisco Identity Services Engine Command Injection Vulnerabilities2026-09-16csaf · cisco_csafUS
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform command injection attacks on an affected device and execute arbitrary commands as the root user. To exploit these vulnerabilities, the attacker must have valid administrative credentials. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP"]. In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"].

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu cisco_csaf ncsc_nl NVD CVE.org MITRE

published 2026-09-16modified 2026-09-23

references (1) nvd

External citations — patches, advisories, analysis.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-e2CuZCYZ

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan