Cisco ISE CVE-2026-20284

Exploitation requires three concrete preconditions stated in the advisory: (1) valid administrative credentials for the ISE node (PR:H), (2) the SXP (Security Group Tag Exchange Protocol) service must be enabled, and (3) at least one SXP connection must already be configured. Because SXP is an optional, non-default TrustSec-related feature, deployments that do not use SXP are not exploitable. The attack is remote over the network (AV:N) with low complexity (AC:L) and no user interaction, but the requirement for an authenticated admin account plus enabled SXP with a live connection materially limits realistic exposure. On single-node ISE deployments only, successful exploitation can additionally cause a DoS that blocks new endpoint authentications until recovery.

This is an authenticated, network-reachable SQL injection in the SXP REST API of Cisco ISE, rated 9.1 by Cisco (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The severity is driven by full C:H/I:H/A:H impact (arbitrary database read/write plus a DoS on single-node deployments) and a scope change (S:C), reflecting that the injected query reaches the underlying database beyond the API's own security scope. The single most important limiter is PR:H: exploitation requires valid administrative credentials AND two non-default preconditions - the SXP service enabled and at least one SXP connection configured - so this is a privilege-escalation/lateral-impact primitive for an already-authenticated admin, not an open perimeter threat. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no signal of active exploitation; the 9.1 is a vendor-asserted technical-impact score rather than evidence of real-world weaponization. Net: real priority for organizations running ISE with SXP enabled and multiple admin tiers (a lower-trust admin could tamper with the identity database), but the PR:H + feature-enablement gating substantially narrows the practical attack surface versus an unauthenticated flaw.

An attacker with valid Cisco ISE administrative credentials, against a deployment where the SXP service is enabled with at least one SXP connection configured, sends crafted input to an SXP REST API call to inject SQL and read or modify the backend database. On a single-node deployment the same request can crash the node, causing a DoS in which unauthenticated endpoints cannot join the network until it is restored. No public proof-of-concept exploit is identified at time of analysis.