CVE-2026-20237

CVE-2026-20237 bundles multiple improper input validation flaws (CWE-20) that Cisco engineers discovered internally during a proactive security review of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). The flaws are triggered by sending crafted input to affected network services, and the CVSS vector indicates an attacker must already hold high-privilege access (such as administrative credentials), with no user interaction required. The scope-changed, critical-rated vector (9.1) implies successful exploitation crosses a security boundary—potentially escaping the intended administrative context—with high impact on confidentiality, integrity, and availability of the appliance. Any organization running Cisco ISE or ISE-PIC as its network access control or identity policy platform is potentially affected. No public proof-of-concept, CISA KEV listing, or known exploitation has been reported; the issues are addressed in a proactive software hardening release.

What to do: Update Cisco ISE and ISE-PIC to the hardening release that addresses CVE-2026-20237 as soon as practical, checking the Cisco PSIRT advisory for the exact fixed version for your release train. Until patched, restrict administrative (high-privilege) access to ISE/ISE-PIC to trusted management networks and audit privileged account usage, since exploitation requires high privileges. Because no exploitation is known and details are limited, monitor Cisco PSIRT for updates and additional affected version information.