CVE-2026-20307: Cisco Identity Services Engine Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to reach the Cisco ISE web-based management interface and possess at least low-privileged administrative credentials. No user interaction is required.
What is the potential impact in a single-node deployment?
Successful exploitation can result in arbitrary code execution with privileges elevated to root. It can also make the ISE node unavailable; endpoints that have not already authenticated may be unable to access the network until the node is restored.
What traffic or activity would indicate an exploitation attempt?
The described exploit uses a crafted serialized Java object sent to the ISE web-based management interface. Review management-interface activity associated with low-privileged administrative accounts for suspicious serialized-object submissions or unexpected command execution.