Critical Cisco ISE Flaws Enable Authenticated RCE and File Exposure
Cisco disclosed two vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that can allow authenticated attackers to execute malicious code and access sensitive files. The most severe flaw, CVE-2026-20147 with a CVSS 9.9, is an authenticated remote code execution issue that can provide user-level operating system access and may be escalated to root. A second flaw, CVE-2026-20148 with a CVSS 4.9, is an authenticated path traversal vulnerability that can expose files from the underlying operating system.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Cisco discloses additional ISE and Webex flaws with security updates
On 2026-04-20, Cisco disclosed additional vulnerabilities affecting ISE, ISE-PIC, and Webex Services, including ISE command-execution flaws CVE-2026-20180 and CVE-2026-20186 and Webex SSO certificate validation flaw CVE-2026-20184. Cisco released software updates, said it had not observed active exploitation, and advised customers to patch immediately because no workarounds were available.
Belgium CCB warns organizations to patch Cisco ISE vulnerabilities
On 2026-04-17, Belgium's Centre for Cybersecurity Belgium (CCB) published an advisory warning about multiple critical Cisco ISE vulnerabilities that could lead to remote code execution and urged immediate patching. This reflects official downstream alerting to affected organizations following Cisco's disclosure.
Cisco discloses two Cisco ISE vulnerabilities and releases fixes
On 2026-04-15, Cisco published a security advisory for two vulnerabilities affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): CVE-2026-20147, a critical authenticated remote code execution flaw (CVSS 9.9), and CVE-2026-20148, an authenticated path traversal flaw (CVSS 4.9). Cisco said there were no workarounds, advised administrators to upgrade to fixed releases immediately, and stated it was not aware of public exploitation at the time of publication.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Cisco ISE Vulnerabilities Enable Remote Code Execution
thecyberexpress.com
Open sourceWarning: Multiple critical vulnerabilities in CISCO ISE that can lead to RCE, Patch Immediately! | CCB Belgium
ccb.belgium.be
Open sourceCritical Cisco ISE Vulnerabilities Let Remote Attackers Execute Malicious Code
cybersecuritynews.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco ISE Flaws Enable Authenticated Remote Code Execution and Root Escalation
Cisco disclosed two high-severity vulnerabilities in **Cisco Identity Services Engine (ISE)**, tracked as `CVE-2026-20180` and `CVE-2026-20186`, that allow an authenticated attacker to execute arbitrary commands on the underlying operating system by sending crafted HTTP requests. Both issues require at least **Read Only Admin** credentials and stem from insufficient validation of user-supplied input; Cisco mapped the flaws to **`CWE-22`** and **`CWE-77`** respectively. Cisco assigned both vulnerabilities the same **CVSS v3.1** score vector: `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. Successful exploitation can provide user-level operating system access and may allow attackers to escalate privileges to **root**. Cisco warned that in **single-node ISE deployments**, exploitation could also make the affected node unavailable, creating a denial-of-service condition that prevents unauthenticated endpoints from accessing the network until the system is restored.
Apr 16, 2026
Cisco ISE Flaws Expose Authentication Bypass, Root RCE, and Path Traversal
Cisco disclosed multiple vulnerabilities in **Identity Services Engine (ISE)** and **ISE-PIC** that could let attackers compromise deployments through **authentication bypass**, **unauthenticated remote code execution**, and **path traversal**. One of the issues, tracked as **`CVE-2025-20281`**, was described in public research as allowing unauthenticated attackers to achieve **remote code execution as root** because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure. Separate Cisco advisories also detailed additional **authentication bypass** weaknesses and a combination of **remote code execution and path traversal** flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for `CVE-2025-20281` increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
May 25, 2026
Critical Unauthenticated RCE Flaws Patched in Cisco ISE and ISE-PIC
Cisco disclosed two critical vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that allow unauthenticated remote attackers to execute arbitrary code on the underlying operating system with **root privileges**. The flaws, tracked as `CVE-2025-20281` and `CVE-2025-20282`, are independent issues, meaning exploitation of one is not required to exploit the other. `CVE-2025-20281` affects Cisco ISE and ISE-PIC **version 3.3 and later**, while `CVE-2025-20282` affects **version 3.4 only**; Cisco said **version 3.2 and earlier are not affected**. Cisco also warned that `CVE-2025-20282` can enable arbitrary file upload and execution on vulnerable devices. Patches have been released, and organizations running affected deployments have been urged to update immediately.
Apr 22, 2026