Cisco ISE CVE-2026-20247

No special conditions stated - the vendor vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation of an affected Cisco ISE device via a single crafted request against default-reachable functionality; no configuration toggle, feature enablement, or user interaction is required per the advisory. The primary LIMITING factors are: network reachability to the ISE management/service interface (typically restricted to internal/management networks in well-segmented deployments), the deliberately narrow impact (data modification only - no confidentiality or availability effect), and applicability only to ISE versions 3.1.x through 3.5.x. Defenders who restrict ISE management-plane exposure to trusted networks substantially reduce realistic exposure.

This is a genuinely notable finding: an unauthenticated, remote SQL injection (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) in Cisco ISE, a ubiquitous enterprise NAC/identity platform. The strongest risk signals are the unauthenticated network vector and low attack complexity - no credentials or user interaction required. However, the impact is deliberately narrow: the vendor vector is C:N/I:H/A:N, meaning the flaw permits only modification of database data, not reading (no data exfiltration) and no service disruption. This is unusual for an unauthenticated SQLi and materially lowers the blast radius versus a full read/write compromise. Countervailing signals lower the urgency: no CISA KEV listing, no public proof-of-concept, and no EPSS score is available, so there is no evidence of active or imminent exploitation. Net assessment: prioritize patching because the unauthenticated vector on a high-value identity appliance is attractive, but this is a high-CVSS integrity flaw rather than a confirmed emergency; the integrity-only scope and absence of exploitation signals argue for prompt-but-scheduled remediation rather than break-glass response. One point to verify with Cisco: unauthenticated SQLi that yields only data modification (not read) is atypical, and the exact affected endpoint/parameter is not disclosed in the advisory summary.

An attacker with only network reachability to an affected Cisco ISE node sends a crafted HTTP request to a vulnerable endpoint that fails to validate user-supplied input, injecting SQL that alters records in the underlying database. Because no authentication or user interaction is required, this could be automated against internet-facing or reachable management interfaces to tamper with identity/policy data. No public exploit code has been identified at time of analysis.