EUVD-2026-81137
GHSA-6q33-6xqh-fh6f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Admin auth required (PR:H) but network-reachable API with low complexity; OS command injection with easy root escalation justifies full C:H/I:H/A:H, raising A above the vendor's A:N.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.
This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit this vulnerability by sending crafted input to the IPsec Open API endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials and the node must have more than one network interface, one of which must be configured as an active IPsec tunnel. Note: For CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.
AnalysisAI
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) valid administrative credentials on Cisco ISE (PR:H) - this is not an unauthenticated flaw; (2) the target ISE node must be configured with more than one network interface; and (3) one of those interfaces must be configured as an active IPsec tunnel - a specific non-default deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), but Cisco explicitly overrides the numeric severity by assigning a Security Impact Rating of High, stating it is 'easy to get to root from the achieved privilege level' - a meaningful conflict where the raw score understates real impact and the vendor's qualitative rating should take precedence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco addresses this in the multi-vulnerability advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc, which is the authoritative source for the exact patched release codes per 3.3, 3.4 and 3.5 train; no specific fixed version is confirmed in the available data, so administrators should consult the advisory and upgrade to the listed first-fixed release for their train rather than assume the current patch level is safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today