CVE-2026-20305: Cisco Identity Services Engine Command Injection Vulnerability
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need before exploitation is possible?
The attacker must be remote, authenticated, and possess valid administrative credentials. Exploitation is performed through the web-based management interface.
Which systems should be prioritized for review?
Cisco ISE and Cisco ISE-PIC systems are affected according to the provided data. Prioritize systems where administrative credentials could be available to untrusted or compromised users.
What is the potential operational impact in a single-node deployment?
Successful exploitation can make the affected ISE node unavailable. Endpoints that have not already authenticated may be unable to access the network until the node is restored.