CVE-2026-20307
CriticalCVSS 9.9Summary
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker must have at least low-privileged administrative credentials. The issue is due to insecure deserialization of a user-supplied Java byte stream; successful exploitation could allow code execution and privilege escalation to root, and in single-node deployments could cause the ISE node to become unavailable (DoS).
Risk Assessment
An attacker with low-privileged administrative credentials could execute arbitrary code as root and take control of the ISE device. In single-node deployments, this could cause an authentication service outage, blocking network access for unauthenticated endpoints.
Recommendation
Immediately apply Cisco security updates for Cisco ISE. Additionally, limit the number of administrative accounts and monitor for unusual requests to the management interface.
Other vulnerabilities in Cisco ISE
See all- CVE-2026-20306Critical
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).
- CVE-2026-20305Critical
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).
- CVE-2026-20234Critical
Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities tracked by CVE-2026-20234 relate to insufficiently protected credentials (CWE-522).
- CVE-2026-20148Medium
A vulnerability in Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker to perform path traversal attacks on the underlying OS and read arbitrary files. The flaw is due to improper validation of user-supplied input.
- CVE-2026-20147Critical
A vulnerability in Cisco ISE and Cisco ISE-PIC allows an authenticated remote administrator to execute arbitrary commands on the underlying OS. The issue is due to insufficient input validation.
- CVE-2026-20195Medium
A vulnerability in an identity management API endpoint of Cisco ISE allows an unauthenticated, remote attacker to enumerate valid user accounts on an affected device. The issue exists due to observable error messages when the API endpoint is called.
- CVE-2026-20193Medium
A vulnerability in the RADIUS Policy API endpoints of Cisco ISE allows an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive information. This is due to improper role-based access control (RBAC) permissions on these API endpoints.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.