Cisco ISE CVE-2026-20352

Exploitation requires network reachability to the RADIUS feature/service of an affected Cisco ISE node (versions 3.2.0 through 3.5, including numerous 3.2/3.3/3.4 patch levels per EUVD). No authentication, credentials, or user interaction are needed (PR:N/UI:N) and the attacker sends the crafted RADIUS request directly to the device. Impact is limited to availability: the node becomes unavailable and self-recovers. The most severe real-world effect is confined to single-node deployments, where unauthenticated endpoints cannot access the network during the outage; redundant/multi-node ISE clusters limit the blast radius, and restricting RADIUS exposure to trusted network segments materially reduces reachability.

This is a genuine but bounded-impact issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6) describes an unauthenticated, remote, low-complexity denial-of-service with no confidentiality or integrity impact - availability-only. The high base score is driven by A:H plus S:C (scope change), the latter reflecting that an ISE node outage cascades to endpoints that rely on it for network access. Exploitation status is 'no public exploit identified at time of analysis': no CISA KEV listing, no POC reference, and no EPSS score is provided in the input. So the raw 8.6 overstates near-term operational urgency relative to a code-execution flaw - a network attacker can knock over a RADIUS/NAC node but cannot read or alter data. Priority is real for organizations exposing ISE RADIUS to untrusted networks (RADIUS/UDP is trivially reachable and spoofable), especially single-node deployments where recovery is self-healing but causes an authentication outage; it is lower where ISE is segmented to trusted infrastructure and deployed in a redundant cluster. Note a CWE/impact tension: CWE-119 and the 'Buffer Overflow' tag imply a memory-corruption class typically associated with code execution, yet Cisco scored C:N/I:N/A:H - the memory error is contained to a crash, not RCE. Absence of EPSS/KEV is expected for a freshly disclosed vendor-reported bug and should not be read as low risk in itself.

An attacker with network reachability to an ISE node's RADIUS service sends a single crafted RADIUS request that trips improper input handling in the RADIUS feature, crashing or hanging the process. On a single-node deployment the node goes offline until it self-recovers, during which not-yet-authenticated endpoints cannot get onto the network. No authentication, user interaction, or POC is required - RADIUS is UDP-based and the request can be sent directly to the device.