CVE-2026-20147
published 2026-04-15CVE-2026-20147: A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system…
PriorityP279critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
11.68%
95.6th percentile
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Affected
129 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect crafted HTTP requests targeting Cisco ISE administrative interface that could indicate exploitation of CVE-2026-20147 (RCE via insufficient input validation) ↗
- →Monitor for unexpected OS-level process spawning from Cisco ISE web service processes, particularly privilege escalation to root, as indicator of successful exploitation ↗
- →Investigate Cisco ISE nodes that become unexpectedly unavailable or cause DoS for endpoints attempting network authentication, as this may indicate exploitation in single-node deployments ↗
- →Track Cisco bug IDs CSCws52717 and CSCws52738 associated with CVE-2026-20147 for vendor patch and detection content updates ↗
- →Flag CWE-22 (Path Traversal) and CWE-77 (Command Injection) patterns in HTTP requests to Cisco ISE administrative endpoints as potential exploitation attempts ↗
- ·Exploitation requires valid administrative credentials; detections should be scoped to authenticated admin sessions to reduce false positives ↗
- ·Cisco ISE releases earlier than 3.1 and ISE-PIC releases earlier than 3.2 have no patch available and must migrate to a fixed release; these instances remain at highest risk ↗
- ·Fixed versions for CVE-2026-20147 include ISE 3.1 Patch 11, 3.2 Patch 10, 3.3 Patch 11, 3.4 Patch 6, and 3.5 Patch 3; detections should prioritize unpatched instances ↗
- ·No evidence of in-the-wild exploitation at time of disclosure; Cisco PSIRT confirmed no known active exploitation ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_cisco3.1
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2026-20147 Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities
CVE-2026-20147: Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to achieve remote code execution or conduct path traversal attacks on an affected device. To exploit these vulnerabilities, the attacker must have valid administrative credentials. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-22, CWE-77, CWE-22, CWE-77
Bug IDs: CSCws52717, CSCws52738, CSCws52738, CSCws52717
VulDB
Cisco Identity Services Engine Software command injection (cisco-sa-ise-rce-traversal-8bYndVrZ / EUVD-2026-22962)
vuldb·2026-04-15·CVSS 9.9
CVE-2026-20147 [CRITICAL] Cisco Identity Services Engine Software command injection (cisco-sa-ise-rce-traversal-8bYndVrZ / EUVD-2026-22962)
A vulnerability described as critical has been identified in Cisco Identity Services Engine Software and ISE Passive Identity Connector. This impacts an unknown function. Such manipulation leads to command injection.
This vulnerability is referenced as CVE-2026-20147. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
GHSA
GHSA-6m6h-8f8v-r7j4: A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating
ghsa_unreviewed·2026-04-15
CVE-2026-20147 [CRITICAL] CWE-77 GHSA-6m6h-8f8v-r7j4: A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, e
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
blogs_hackernews·2026-04-20
CVE-2026-20184 ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.
There’s also a shift in how attacks run. Slower check-ins, multi-stage payloads, andmore code kept in memory. Attackers lean on real tools and normal workflows instead of custom builds. Some cas
Bleepingcomputer
Cisco says critical Webex Services flaw requires customer action
blogs_bleepingcomputer·2026-04-16·CVSS 9.9
[CRITICAL] Cisco says critical Webex Services flaw requires customer action
## Cisco says critical Webex Services flaw requires customer action
## Sergiu Gatlan
Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company's cloud-based Webex Services platform that requires further customer action.
Webex Services is a customer experience platform that unifies communication across hybrid work environments, enabling team members to call, meet, and message each other from any location or device.
Tracked as CVE-2026-20184 , the Webex vulnerability was found in the single sign-on (SSO) integration with Control Hub (a web-based portal that helps IT admins manage Webex settings) and allows remote attackers with no privileges to impersonate any user.
"Prior to this vulnerability being
Hackernews
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
blogs_hackernews·2026-04-16·CVSS 9.9
[CRITICAL] Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service.
The details of the vulnerabilities are below -
CVE-2026-20184 (CVSS score: 9.8) - An improper certificate validation in the integration of single sign-on (SSO) with Control Hub in Webex Services that could allow an unauthenticated, remote attacker to impersonate any user within the service and gain unauthorized access t
2026-04-15
Published