Critical [CVE-2026-20282 +2] Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities
This critical-severity Cisco advisory covers CVE-2026-20282 and CVE-2026-20283 and 1 more CVE affecting Identity Services Engine Software.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 3 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct SQL injections, modify data, or execute arbitrary commands on the underlying operating system on an affected device.
For more information about these vulnerabilities, see the Details section of this advisory.
Note: For CVE-2026-20282 and CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the scores indicate. The reason is that it is easy to get to root from the achieved privilege level.
Cisco has released software updates that address these vulnerabilities. There are workarounds that address one of these vulnerabilities.
This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories.
In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026.
Affected product named by the advisory: Identity Services Engine Software.
- Scope: CVE-2026-20284: This vulnerability affects Cisco ISE if the SXP service is enabled and at least one SXP connection is configured.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- CVE-2026-20282 and CVE-2026-20284: There are no workarounds that address these vulnerabilities.
- CVE-2026-20283: There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured.
- If a vulnerable configuration is present, do the following:
- Return to Administration > System > Settings > Protocols > IPsec > Native IPsec.
- Choose the tunnel with the vulnerable configuration and remove it.
- Add the tunnel back using the web interface.
- While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer depl…
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.