Cisco ISE CVE-2026-20130

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and only low attack complexity are required - exploitation is possible by a remote unauthenticated attacker that can reach the Cisco ISE/ISE-PIC service over the network. The primary LIMITING factor is network exposure: ISE administrative/service interfaces are typically deployed on protected management networks, so realistic exploitation depends on the attacker having reachability to the appliance. A secondary caveat is that this is a grouped internal-review hardening advisory, so the exact triggering feature/protocol path within the CWE-74 injection class is not specified by the vendor; defenders should restrict ISE/ISE-PIC management-plane exposure and apply the fixed release from cisco-sa-hardening-ise-XU5EwX5T.

This vulnerability presents the maximum possible CVSS 3.1 base score (10.0) driven by AV:N/AC:L/PR:N/UI:N with S:C and full C:H/I:H/A:H - network-reachable, low-complexity, unauthenticated, requiring no user interaction, and crossing a scope boundary to achieve total compromise. Among the CVEs bundled into Cisco's ISE hardening release (advisory cisco-sa-hardening-ise-XU5EwX5T), this is one of the top-tier members carrying PR:N, unlike the PR:H authenticated siblings (CVE-2026-20194, CVE-2026-20237) that require valid high-privilege admin credentials; it sits alongside CVE-2026-20192 (also 10.0, PR:N) as the unauthenticated worst case. Counter-signals temper the raw score: there is NO EPSS probability, NO CISA KEV listing, and NO public POC, so there is no evidence of active or imminent exploitation - this is 'no public exploit identified at time of analysis.' A further important caveat is that this is a VAGUE grouped hardening advisory from an internal Cisco security review - the CWE-74 injection classification and the C:H/I:H/A:H+S:C impact are vendor-asserted for a bundle of internally-discovered issues rather than a single independently-analyzed vulnerability, so the precise mechanism and reachability are not externally verifiable. Net: this warrants HIGH patching priority because of the unauthenticated network vector against a critical identity/NAC appliance, but the absence of exploitation signals means it is a proactive-patch priority, not a confirmed-under-attack emergency.

A remote, unauthenticated attacker with network reachability to an internet- or management-exposed Cisco ISE/ISE-PIC node sends crafted input that is improperly neutralized (CWE-74 injection class), triggering execution or data manipulation that crosses a security boundary (S:C) to fully compromise the appliance. Because ISE is a central authentication/NAC control point, such compromise can cascade into broader network access-control subversion. No public exploit code or active exploitation has been identified at time of analysis; the mechanism is asserted by Cisco's internal review rather than demonstrated publicly.