Cisco ISE Flaws Expose Networks to RCE and Sensitive Data Disclosure
Cisco disclosed two vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), including the critical remote code execution flaw CVE-2026-20181 and the high-severity information disclosure flaw CVE-2026-20190. Cisco said CVE-2026-20181 carries a CVSS score of 9.1 and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated 7.5, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks.
The affected software includes all releases prior to 3.3, versions before 3.3 Patch 11 in release 3.3, versions before 3.4 Patch 6 in release 3.4, and versions before 3.5 Patch 4 in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Cisco releases patches for affected ISE and ISE-PIC versions
Cisco released security updates for affected products on 2026-06-17, directing customers to upgrade from vulnerable releases to fixed versions including ISE 3.3 Patch 11, 3.4 Patch 6, and 3.5 patched releases. The advisories covered all releases prior to 3.3 and specified patched versions for the 3.3, 3.4, and 3.5 branches.
Cisco discloses two Cisco ISE and ISE-PIC vulnerabilities
On 2026-06-17, Cisco publicly disclosed two vulnerabilities affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC): CVE-2026-20181, a critical authenticated remote code execution flaw, and CVE-2026-20190, a high-severity information disclosure flaw. Cisco said the issues are independent, no workarounds are available, and there was no confirmed exploitation at the time of disclosure.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
7 references tracked. Mallory keeps watching after this page renders.
Cisco fixed a critical ISE vulnerability that lets attackers to gain root access
securityaffairs.com
Open sourceCisco ISE Vulnerability Allow Attacker to Execute Malicious Code Remotely
cybersecuritynews.com
Open sourceCritical Command Execution Vulnerability Patched in Cisco ISE - SecurityWeek
securityweek.com
Open sourceCisco ISE Vulnerabilities: Critical RCE & Data Risks
securityonline.info
Open sourceCisco security advisory (AV26-613) - Canadian Centre for Cyber Security
cyber.gc.ca
Open sourceCVE-2026-20181 - Cisco Identity Services Engine Remote Code Execution Vulnerability
cvefeed.io
Open sourceCisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities
sec.cloudapps.cisco.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical Unauthenticated RCE Flaws Patched in Cisco ISE and ISE-PIC
Cisco disclosed two critical vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that allow unauthenticated remote attackers to execute arbitrary code on the underlying operating system with **root privileges**. The flaws, tracked as `CVE-2025-20281` and `CVE-2025-20282`, are independent issues, meaning exploitation of one is not required to exploit the other. `CVE-2025-20281` affects Cisco ISE and ISE-PIC **version 3.3 and later**, while `CVE-2025-20282` affects **version 3.4 only**; Cisco said **version 3.2 and earlier are not affected**. Cisco also warned that `CVE-2025-20282` can enable arbitrary file upload and execution on vulnerable devices. Patches have been released, and organizations running affected deployments have been urged to update immediately.
Apr 22, 2026
Cisco ISE Flaws Expose Authentication Bypass, Root RCE, and Path Traversal
Cisco disclosed multiple vulnerabilities in **Identity Services Engine (ISE)** and **ISE-PIC** that could let attackers compromise deployments through **authentication bypass**, **unauthenticated remote code execution**, and **path traversal**. One of the issues, tracked as **`CVE-2025-20281`**, was described in public research as allowing unauthenticated attackers to achieve **remote code execution as root** because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure. Separate Cisco advisories also detailed additional **authentication bypass** weaknesses and a combination of **remote code execution and path traversal** flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for `CVE-2025-20281` increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
May 25, 2026
Cisco ISE Flaws Enable Authenticated Remote Code Execution and Root Escalation
Cisco disclosed two high-severity vulnerabilities in **Cisco Identity Services Engine (ISE)**, tracked as `CVE-2026-20180` and `CVE-2026-20186`, that allow an authenticated attacker to execute arbitrary commands on the underlying operating system by sending crafted HTTP requests. Both issues require at least **Read Only Admin** credentials and stem from insufficient validation of user-supplied input; Cisco mapped the flaws to **`CWE-22`** and **`CWE-77`** respectively. Cisco assigned both vulnerabilities the same **CVSS v3.1** score vector: `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. Successful exploitation can provide user-level operating system access and may allow attackers to escalate privileges to **root**. Cisco warned that in **single-node ISE deployments**, exploitation could also make the affected node unavailable, creating a denial-of-service condition that prevents unauthenticated endpoints from accessing the network until the system is restored.
Apr 16, 2026