CVE-2026-20306

Cisco ISE and ISE-PIC contain a command injection vulnerability (CWE-78) in their REST API, caused by improper validation of user-supplied input. An authenticated, remote attacker who already holds valid administrative credentials can send crafted commands to the web-based management interface to trigger the flaw. Successful exploitation allows arbitrary code execution on the underlying operating system with elevation to root privileges. In single-node deployments, exploitation can also render the ISE node unavailable, denying network access to endpoints that have not yet authenticated. As of the latest data, the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Upgrade ISE and ISE-PIC to the fixed releases identified in the Cisco Security Advisory (version numbers not provided in available data). Until patched, restrict access to the management and REST API interfaces to trusted admin networks, audit and rotate privileged administrative credentials (since valid admin creds are required for exploitation), and enable MFA for ISE administrators. Organizations running single-node deployments should prioritize patching and maintain backups, as exploitation could take the sole node offline and block new endpoint authentication.