EUVD-2026-81140
GHSA-pfwv-v5q9-qwh6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Network HTTP vector, low complexity, admin creds required (PR:H); Cisco confirms trivial escalation to root, so I score full C/I/A:H rather than the vendor's write-only I:H.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain write access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.
AnalysisAI
Remote, authenticated administrators of Cisco Identity Services Engine (ISE) can escalate from the web management interface to write access on the appliance's underlying operating system by sending a single crafted HTTP request, and Cisco confirms root is easy to reach from that primitive, making the practical outcome full device compromise. The flaw is improper restriction of resource/file names (CWE-641) in the ISE management web/API layer, reachable over the network with no user interaction but requiring valid administrative credentials (CVSS 3.1 PR:H), so it is a post-authentication escalation path rather than a pre-auth entry point. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess valid administrative credentials on the Cisco ISE device (PR:H) and network reachability to the ISE management HTTP interface (AV:N); exploitation is a single crafted HTTP request against affected ISE 3.1.x through 3.5.x releases with no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 base score is 4.9 (Medium), but this understates real risk and Cisco itself flags the gap: the vendor assigned a Security Impact Rating (SIR) of High, explicitly because it is easy to escalate from the achieved write-access primitive to full root on the underlying OS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is provided in the supplied data, so the authoritative next step is to consult Cisco's advisory cisco-sa-ise-mult-vul-ymSsTLCc (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc) for the patched release on your branch and upgrade, since this is a post-authentication admin-to-root escalation with no configuration toggle that removes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today