CVE-2026-20180 — Path Traversal in Cisco Identity Services Engine Software

CWE-22 — Path Traversal4 documents4 sources
Severity
9.9CRITICALNVD
EPSS
0.2%
top 56.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Identity Services Engine Software
Timeline
PublishedApr 15

Description

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages1 packages

🔴Vulnerability Details

3
VulDB
Cisco Identity Services Engine Software up to 3.5.0 path traversal (cisco-sa-ise-rce-4fverepv / EUVD-2026-22970)↗2026-04-15
▶
GHSA
GHSA-6fqc-22r3-wrxm: A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying↗2026-04-15
▶
CVEList
Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability↗2026-04-15
▶
CVE-2026-20180 — Path Traversal in Cisco | cvebase