EUVD-2026-81163
GHSA-8p6f-w9f5-263x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-reachable admin interface with low complexity, but improper privilege management requires an existing high-privilege account (PR:H); high confidentiality/integrity impact, no availability effect claimed.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20287 are related to improper privilege managment issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-269.
AnalysisAI
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high-privilege authenticated access to the Cisco ISE or ISE-PIC administrative management plane (PR:H), reachable over the network (AV:N) with no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, defense-in-depth issue rather than an urgent internet-facing threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco addressed CVE-2026-20287 as part of a consolidated software hardening release for ISE and ISE-PIC, so the primary action is to upgrade each appliance to the fixed build identified for its 3.x train in the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T; the advisory is a grouped multi-CVE bulletin and the exact per-train patched version is specified there rather than in the CVE record, so confirm the target release against that matrix before scheduling the upgrade and apply the corresponding ISE-PIC update in any passive-identity deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today