Cisco ISE Patches Critical Command Execution Vulnerability

Cisco has issued updates to resolve a critical command execution vulnerability affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).

The flaw, designated CVE-2026-20181 with a CVSS score of 9.1, arises from insufficient validation of user input, enabling an attacker to craft malicious HTTP requests and achieve user-level access to the underlying operating system. Exploitation requires valid administrative credentials, allowing the attacker to escalate privileges to root. In single-node configurations, the vulnerability could also trigger a denial-of-service (DoS) condition. The vulnerability was mitigated through the release of ISE and ISE-PIC versions 3.3 Patch 11 and 3.4 Patch 6. A hotfix for ISE version 3.5 is available and will be incorporated into version 3.5 Patch 4 scheduled for August. The updates also resolve a high-severity information disclosure issue, CVE-2026-20190, which could permit unauthenticated attackers to access sensitive data such as hashed credentials. In addition to these fixes, Cisco addressed medium-severity flaws in the Webex App, Umbrella Virtual Appliance, and Crosswork Network Controller. These issues could enable malicious redirects, privilege escalation, and arbitrary command execution. The company confirmed no evidence of these vulnerabilities being actively exploited in the wild. Further details are available in Cisco’s security advisories.

About Author

Anuj

See author's posts