EUVD-2026-80884
GHSA-m8gm-7wx7-cf56
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote REST API access (AV:N), but valid admin credentials are mandatory (PR:H); injection yields root code execution escaping the app context into the OS (S:C) with full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
AnalysisAI
Command injection in the REST API of Cisco ISE and ISE-PIC allows authenticated administrators to execute arbitrary commands with root privileges on the underlying operating system, potentially leading to complete node compromise and, in single-node deployments, a denial-of-service condition. This vulnerability (CVE-2026-20306) requires valid administrative credentials (PR:H) and network access to the management interface; no public exploit code has been identified at the time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid Cisco ISE administrative credentials (PR:H) and network reachability to the web-based management interface / REST API of an affected ISE or ISE-PIC node; no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven primarily by the total technical impact (C:H/I:H/A:H, root code execution) and the scope change (S:C, OS compromise from the web-management context), NOT by ease of access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches or mitigations provided in the Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-e2CuZCYZ). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco ISE and ISE-PIC node, identify which sites run single-node or otherwise non-redundant topologies, and restrict management-interface reachability to dedicated administrative VLANs or hardened jump hosts so only trusted source addresses can reach the admin REST API; simultaneously review the administrative account roster, disable shared or unused admin accounts, rotate credentials where compromise is plausible, and enable multi-factor authentication for all remaining administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today