Cisco ISE CVE-2026-20186

Exploitation requires valid Cisco ISE administrative credentials at minimum the Read-Only Admin role (CVSS PR:L) and network reach to the ISE management HTTP interface; the attack is a single crafted HTTP request with no user interaction (UI:N) and low complexity (AC:L). Limiting factors: it is NOT unauthenticated - an attacker with no ISE account cannot exploit it - and realistic risk depends on whether the admin interface is exposed beyond a restricted management network and on how broadly the Read-Only Admin role is provisioned. The root-level outcome depends on the described in-chain privilege escalation from the initial user-level OS access, and the denial-of-service outcome is specific to single-node ISE deployments.

Signals conflict in the usual pattern for enterprise appliance CVEs: the CVSS base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) driven by network reachability, low complexity, scope change and root-level impact, yet EPSS is only 0.23% (46th percentile) and CISA SSVC lists Exploitation: none and Automatable: no, indicating no observed or easily-weaponized exploitation despite Technical Impact: total. The realistic gate is that the attacker must already hold valid Read-Only Admin credentials (PR:L), which meaningfully narrows the population to insiders, compromised admin accounts, or environments exposing the ISE management interface - so this is a credentialed privilege-escalation/RCE rather than a pre-auth internet worm candidate. That said, ISE admin consoles are frequently reachable from internal management networks and a Read-Only role is often handed out liberally, so even a mid-sized municipal IT team in kalisz should treat a low-privilege-to-root path on their central NAC as urgent given the total OS compromise and single-node DoS consequences. Net: a high-priority patch item for anyone running ISE, but current data points to targeted rather than mass exploitation.

An attacker who has obtained Cisco ISE Read-Only Admin credentials - whether an insider, a contractor, or via a phished/reused admin login - sends a crafted HTTP request to the ISE management interface whose parameters inject shell commands. The commands run as a lower-privileged OS user and the attacker then leverages a follow-on escalation to gain root, achieving full control of the appliance; on a single-node deployment the same activity can instead knock the node offline, blocking new endpoint authentications. No public exploit code is identified at time of analysis.