EUVD-2026-22962
GHSA-6m6h-8f8v-r7j4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Requires administrative credentials (PR:H) per vendor, network vector, no user interaction, scope changed due to OS compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
AnalysisAI
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
Technical ContextAI
The vulnerability stems from improper neutralization of special elements in a command (CWE-77) in the web-based management interface of Cisco ISE and ISE-PIC. Insufficient validation of user-supplied input within an HTTP request allows an attacker to inject operating system commands. Affected products are identified by CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector.
RemediationAI
Cisco has released patched software versions; administrators should upgrade to the fixed release indicated in the vendor advisory cisco-sa-ise-rce-traversal-8bYndVrZ. As an immediate compensating control, restrict administrative access to the ISE management interface to a limited set of trusted IP addresses and monitor for anomalous administrative activity. In environments where patching is delayed, consider disabling the vulnerable management interface if not needed, though this will impact normal administrative operations.
We need to produce a JSON with specific fields. The input: CVE-2026-20186, a Cisco ISE vulnerability. Description says:
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unaut
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to i
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, aut
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authentica
We need to produce a JSON object with the specified fields. Let's begin by examining all provided data. CVE-2026-20132:
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADI
Same weakness CWE-77 – Command Injection
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today