CVE-2026-20147

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This is due to insufficient authorization checks in the REST API web service. An attacker can send crafted HTTP requests to the exposed REST API port to read and modify configuration and identity data with administrative privileges.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker must have at least low-privileged administrative credentials. The issue is due to insecure deserialization of a user-supplied Java byte stream; successful exploitation could allow code execution and privilege escalation to root, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities tracked by CVE-2026-20234 relate to insufficiently protected credentials (CWE-522).

A vulnerability in Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker to perform path traversal attacks on the underlying OS and read arbitrary files. The flaw is due to improper validation of user-supplied input.

A missing authentication vulnerability exists in the Policy Runtime Repository Table (PRRT) service of Cisco ISE and Cisco ISE-PIC. An unauthenticated remote attacker could send a crafted request to retrieve sensitive configuration information from an affected device.

Insufficient authentication on an internal interface exposed through the guest portal of Cisco ISE allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline. A crafted request can manipulate posture status on the affected system.

Insufficient validation of user-supplied input in the certificate import functionality of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files. A crafted request can expose sensitive information.