Cisco ISE CVE-2026-20282

The attacker must possess valid administrative credentials on the Cisco ISE device (PR:H) and network reachability to the ISE management HTTP interface (AV:N); exploitation is a single crafted HTTP request against affected ISE 3.1.x through 3.5.x releases with no user interaction. The primary limiting factor is the requirement for pre-existing admin-level access - this is not a pre-auth flaw - but once that access exists, Cisco states escalation to root is easy, so the practical impact is full OS compromise. Applies to default configurations of affected versions; no special feature toggle is named as a prerequisite.

The published CVSS 3.1 base score is 4.9 (Medium), but this understates real risk and Cisco itself flags the gap: the vendor assigned a Security Impact Rating (SIR) of High, explicitly because it is easy to escalate from the achieved write-access primitive to full root on the underlying OS. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N shows a network-reachable, low-complexity attack requiring high privileges (valid administrative credentials) and no user interaction, with the low base score driven entirely by scoring only the direct write primitive (I:H, C:N/A:N) rather than the root outcome. There is a genuine signal conflict here: the numeric CVSS says Medium while the vendor SIR and the description's own root-escalation note argue for High - defenders should treat this closer to a High/root-compromise issue. Exploitation status is 'no public exploit identified at time of analysis' - no KEV listing, no POC, and no EPSS score are provided, so there is no evidence of active or widespread exploitation; the PR:H requirement for admin credentials meaningfully limits the attacker population to those already holding privileged access (whether legitimately, via credential theft, or via chaining another auth bypass). Net: a real hardening priority for internet- or management-plane-exposed ISE, but not an emergency mass-exploitation scenario absent a credential-compromise or chaining precondition.

An attacker holding valid Cisco ISE administrative credentials sends a crafted HTTP request that exploits insufficient validation of user-supplied input (CWE-641) to write to the underlying operating system. Because getting from that write primitive to root is trivial per Cisco, the attacker converts admin-plane access into full OS/root compromise of the ISE node. No public exploit code is identified at time of analysis.