Cisco ISE vulnerabilities

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This is due to insufficient authorization checks in the REST API web service. An attacker can send crafted HTTP requests to the exposed REST API port to read and modify configuration and identity data with administrative privileges.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker must have at least low-privileged administrative credentials. The issue is due to insecure deserialization of a user-supplied Java byte stream; successful exploitation could allow code execution and privilege escalation to root, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities tracked by CVE-2026-20234 relate to insufficiently protected credentials (CWE-522).

A vulnerability in Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker to perform path traversal attacks on the underlying OS and read arbitrary files. The flaw is due to improper validation of user-supplied input.

A vulnerability in Cisco ISE and Cisco ISE-PIC allows an authenticated remote administrator to execute arbitrary commands on the underlying OS. The issue is due to insufficient input validation.

A missing authentication vulnerability exists in the Policy Runtime Repository Table (PRRT) service of Cisco ISE and Cisco ISE-PIC. An unauthenticated remote attacker could send a crafted request to retrieve sensitive configuration information from an affected device.

Insufficient authentication on an internal interface exposed through the guest portal of Cisco ISE allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline. A crafted request can manipulate posture status on the affected system.

Insufficient validation of user-supplied input in the certificate import functionality of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files. A crafted request can expose sensitive information.

Insufficient validation of directory traversal character sequences in a user-supplied path in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to access protected files. A crafted request to the provisioning download service can expose sensitive information.

Improper validation of directory traversal character sequences during file upload in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker with administrative privileges to write arbitrary files. A crafted file upload can write to arbitrary locations.

Improper validation of directory traversal character sequences in a user-supplied file path in the file management function of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to delete arbitrary files and directories. A crafted request can delete files on the underlying operating system.

SQL injection vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC due to certain parameters being concatenated directly into SQL clauses without parameterization. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the session database.

XML external entity vulnerability in the offline profiler feed service of Cisco ISE due to parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with administrative credentials can upload a crafted offline feed package to read arbitrary files and issue requests to internal systems.

SQL injection vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of specific parameters that are concatenated into an SQL statement. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the monitoring database.

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint.

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path.

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device.

Vulnerability in Cisco ISE allows an authenticated, remote attacker to perform SQL injection attacks on an affected device. Low-privileged administrative credentials are required. This is due to improper validation of user-supplied input.

Vulnerability in Cisco ISE allows an unauthenticated, remote attacker to perform SQL injection attacks on an affected device. This is due to improper validation of user-supplied input.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users outside the security group the attacker is assigned to. It exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could export users and view passwords normally not visible to administrators.

A vulnerability in the SSID BYOD onboarding workflow of Cisco ISE is caused by insufficient authentication checks performed while a user is being onboarded. An unauthenticated, adjacent attacker can spoof the legitimate user and trigger a redirection to the guest web portal, hijacking the onboarding session.

A vulnerability in an identity management API endpoint of Cisco ISE allows an unauthenticated, remote attacker to enumerate valid user accounts on an affected device. The issue exists due to observable error messages when the API endpoint is called.

A vulnerability in the RADIUS Policy API endpoints of Cisco ISE allows an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive information. This is due to improper role-based access control (RBAC) permissions on these API endpoints.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. It is due to insufficient validation of user-supplied input, and an attacker could inject malicious code into specific pages of the interface.

A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate privileges to root. It is due to improper privilege management in the ESR console, and an attacker could send a crafted request to an affected device.