CVE-2026-20284: Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Exploitation requires the SXP service to be enabled and at least one SXP connection to be configured. An attacker must also be able to reach the SXP REST API remotely and possess valid administrative credentials.
Are lower-privileged or unauthenticated attackers able to exploit this issue?
The provided information states that valid administrative credentials are required. It does not indicate that unauthenticated or lower-privileged users can exploit the vulnerability.
What is the operational impact in a single-node deployment?
A successful exploit can make the affected ISE node unavailable. Endpoints that have not already authenticated would then be unable to access the network until that node is restored.