CVE-2026-20186 — Command Injection in Cisco Identity Services Engine Software

CWE-77 — Command Injection4 documents4 sources
Severity
9.9CRITICALNVD
EPSS
0.2%
top 54.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Identity Services Engine Software
Timeline
PublishedApr 15

Description

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages1 packages

🔴Vulnerability Details

3
VulDB
Cisco Identity Services Engine Software up to 3.4.0 command injection (cisco-sa-ise-rce-4fverepv / EUVD-2026-22973)↗2026-04-15
▶
CVEList
Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability↗2026-04-15
▶
GHSA
GHSA-4w7q-f6rr-2p4r: A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying↗2026-04-15
▶
CVE-2026-20186 — Command Injection in Cisco | cvebase