Cisco ISE CVE-2026-20211

Requires valid HIGH-PRIVILEGED administrative credentials on Cisco ISE (PR:H) - this is the primary limiting factor, restricting exploitation to attackers who already hold trusted admin access or have first compromised such an account. The attack is remote/network-based (AV:N) with no user interaction, and works by sending a crafted serialized Java object to the affected node to trigger insecure Java deserialization; no non-default feature toggle is cited. The DoS outcome is specifically limited to SINGLE-NODE deployments, where a successful exploit can render the ISE node unavailable so that unauthenticated endpoints cannot join the network until the node is restored (distributed/multi-node deployments are more resilient to that availability impact).

The vendor CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven by the scope change (S:C) and full C:H/I:H/A:H triad reflecting root-level OS compromise via insecure Java deserialization (CWE-502). However, the single most important risk-modulating signal is PR:H: exploitation requires the attacker to ALREADY hold valid high-privileged administrative credentials on Cisco ISE. That is a near-fully-trusted position, so the practical incremental gain is escaping the application context to an OS root shell rather than gaining initial access - meaningfully lowering real-world urgency versus an unauthenticated RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatable mass-exploitation at this time; this reads as a targeted post-compromise/privilege-boundary escalation issue, not a spray-and-pray internet threat. Net: a genuine and serious flaw for defense-in-depth (admin-to-root and admin-to-OS is a real trust-boundary break), but the effective priority is lower than the 9.1 implies for organizations that tightly control ISE admin credentials. Missing data to note: exact affected/fixed ISE versions are not enumerated in the input (CPE is wildcard), and there is no EPSS/KEV/POC signal to corroborate exploitation likelihood.

An attacker who has obtained (or abused) high-privileged Cisco ISE administrator credentials sends a crafted serialized Java object to the affected node, triggering insecure deserialization to gain user-level command execution on the underlying OS, then escalates to root. In a single-node deployment, a botched or deliberate exploit can crash the ISE node, creating a DoS in which not-yet-authenticated endpoints cannot access the network until the node is restored. No public exploit code was identified at time of analysis.