CVE-2026-20285
MediumCVSS 4.3Summary
Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.
Risk Assessment
An attacker with valid Administrator credentials can modify device configuration, potentially leading to unauthorized changes and misleading operational staff.
Recommendation
Apply the Cisco fix and enforce least privilege and configuration change auditing in ISE and ISE-PIC.
Other vulnerabilities in Cisco Identity Services Engine (ISE)
See all- CVE-2026-76451Medium
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.
- CVE-2026-76450Medium
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.
- CVE-2026-76449Medium
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.
- CVE-2026-76448Medium
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.
- CVE-2026-76447Medium
A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to cause an administrative reload of the OCSP responder certificate and key material. It is caused by missing authentication on a function of the OCSP responder. An attacker could send a crafted request to trigger the reload of certificate and key material on demand.
- CVE-2026-76446Medium
A vulnerability in an API of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker to read specific files on the underlying operating system of an affected device. It is caused by improper restriction of XML external entity references (XXE). An attacker could send a crafted request to read files that the underlying process has permission to access.
- CVE-2026-20309Medium
The web-based management interface of Cisco Identity Services Engine (ISE) does not properly validate user-supplied input, allowing an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack. By persuading a user to click a crafted link, the attacker can execute arbitrary script code in the context of the interface or access sensitive browser-based information.
- CVE-2026-20287Medium
An internal security review by Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams revealed multiple vulnerabilities related to improper privilege management (CWE-269). A software hardening release addressing these internally discovered issues has been made available.
- CVE-2026-20286Medium
Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.
- CVE-2026-20283Medium
Insufficient validation of user-supplied input in IPsec Open API calls in Cisco ISE allows an authenticated remote attacker to inject arbitrary commands on the underlying operating system. Exploitation requires valid administrative credentials and a node with more than one network interface, one of which is an active IPsec tunnel.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials.