EUVD-2026-81106
GHSA-4jvq-wwxw-c7g2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vendor vector accepted: unauthenticated network injection (CWE-74) with scope change and full C/I/A compromise of a NAC appliance; impact is vendor-asserted for a grouped advisory.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
AnalysisAI
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and only low attack complexity are required - exploitation is possible by a remote unauthenticated attacker that can reach the Cisco ISE/ISE-PIC service over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents the maximum possible CVSS 3.1 base score (10.0) driven by AV:N/AC:L/PR:N/UI:N with S:C and full C:H/I:H/A:H - network-reachable, low-complexity, unauthenticated, requiring no user interaction, and crossing a scope boundary to achieve total compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release provided in Cisco's hardening advisory (cisco-sa-hardening-ise-XU5EwX5T, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T); the advisory does not list an exact fix version in the provided data, so consult it for the specific patched releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) deployments, verify none of their management or service interfaces are reachable from untrusted networks, and restrict access to trusted management networks using firewall rules or ACLs; also enable detailed logging and review for anomalous access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today