CVE-2026-20186
published 2026-04-15CVE-2026-20186: A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating…
PriorityP277critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
6.31%
92.8th percentile
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on unexpected ISE node unavailability or DoS conditions in single-node deployments, which may indicate active exploitation of CVE-2026-20180 or CVE-2026-20186. ↗
- →CWE-22 (Path Traversal) and CWE-77 (Command Injection) are the root cause classes; tune WAF/IDS rules on ISE HTTP endpoints for path traversal sequences and OS command injection patterns. ↗
- →CVE-2026-20186 shares the same advisory (cisco-sa-ise-rce-4fverepv) and exploitation vector as CVE-2026-20180; correlate detections across both CVEs when investigating ISE compromise. ↗
- ·Exploitation requires at minimum Read Only Admin credentials on the targeted Cisco ISE device; unauthenticated exploitation is not possible for this CVE. ↗
- ·DoS impact (node unavailability blocking unauthenticated endpoints from network access) is specific to single-node ISE deployments; multi-node deployments have different risk profiles. ↗
- ·Cisco PSIRT confirmed no known in-the-wild exploitation at time of advisory publication; however, patching is urgent given CVSS 9.9 score and read-only credential requirement lowering the exploitation bar. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_cisco3.1
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Identity Services Engine Remote Code Execution Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2026-20186 Cisco Identity Services Engine Remote Code Execution Vulnerabilities
CVE-2026-20186: Cisco Identity Services Engine Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit these vulnerabilities, the attacker must have at least Read Only Admin credentials. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root . In single-node Cisco ISE deployments, successful exploitation of these vulnerabilities c
VulDB
Cisco Identity Services Engine Software up to 3.4.0 command injection (cisco-sa-ise-rce-4fverepv / EUVD-2026-22973)
vuldb·2026-04-15·CVSS 9.9
CVE-2026-20186 [CRITICAL] Cisco Identity Services Engine Software up to 3.4.0 command injection (cisco-sa-ise-rce-4fverepv / EUVD-2026-22973)
A vulnerability classified as critical was found in Cisco Identity Services Engine Software. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to command injection.
This vulnerability is tracked as CVE-2026-20186. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-4w7q-f6rr-2p4r: A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying
ghsa_unreviewed·2026-04-15
CVE-2026-20186 [CRITICAL] CWE-77 GHSA-4w7q-f6rr-2p4r: A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In t
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
blogs_hackernews·2026-04-20
CVE-2026-20184 ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.
There’s also a shift in how attacks run. Slower check-ins, multi-stage payloads, andmore code kept in memory. Attackers lean on real tools and normal workflows instead of custom builds. Some cas
Bleepingcomputer
Cisco says critical Webex Services flaw requires customer action
blogs_bleepingcomputer·2026-04-16·CVSS 9.9
[CRITICAL] Cisco says critical Webex Services flaw requires customer action
## Cisco says critical Webex Services flaw requires customer action
## Sergiu Gatlan
Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company's cloud-based Webex Services platform that requires further customer action.
Webex Services is a customer experience platform that unifies communication across hybrid work environments, enabling team members to call, meet, and message each other from any location or device.
Tracked as CVE-2026-20184 , the Webex vulnerability was found in the single sign-on (SSO) integration with Control Hub (a web-based portal that helps IT admins manage Webex settings) and allows remote attackers with no privileges to impersonate any user.
"Prior to this vulnerability being
Hackernews
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
blogs_hackernews·2026-04-16·CVSS 9.9
[CRITICAL] Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service.
The details of the vulnerabilities are below -
CVE-2026-20184 (CVSS score: 9.8) - An improper certificate validation in the integration of single sign-on (SSO) with Control Hub in Webex Services that could allow an unauthenticated, remote attacker to impersonate any user within the service and gain unauthorized access t
2026-04-15
Published