CVE-2026-20247

Cisco Identity Services Engine (ISE) contains a SQL injection vulnerability (CWE-89) caused by improper validation of user-supplied input. An unauthenticated, remote attacker can trigger it by sending a crafted request to an affected device, requiring no credentials or user interaction. A successful exploit allows the attacker to modify data in the underlying ISE database; Cisco's CVSS scoring (C:N/I:H/A:N) frames this as an integrity-only impact, with no confidentiality or availability loss. Any organization running Cisco ISE is affected, though the device is typically deployed on internal networks rather than exposed to the internet. As of now there is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Check Cisco's security advisory for CVE-2026-20247 and upgrade ISE to the fixed release it specifies for your deployment. Until patching, restrict network access to ISE web-based interfaces (admin and portal) to trusted management networks and monitor for unexpected database changes. Confirm your ISE node inventory, since distributed deployments mean every node in the cluster must be remediated.