CVE-2026-20307

Cisco Identity Services Engine (ISE) contains an insecure deserialization flaw (CWE-502) in its web-based management interface, caused by unsafe handling of a user-supplied Java byte stream. An attacker who already holds at least low-privileged administrative credentials can send a crafted serialized Java object to the management interface to trigger the flaw. Successful exploitation yields arbitrary code execution on the underlying operating system and privilege escalation to root; in single-node deployments it can also render the ISE node unavailable, blocking network access for endpoints that have not yet authenticated. All Cisco ISE deployments whose management interface is reachable by an attacker with administrative credentials are affected, though specific version ranges were not provided in the source data. As of now the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Upgrade affected ISE nodes to the fixed release identified in Cisco's advisory. Until patched, restrict access to the ISE web management interface to trusted administrative networks and audit which accounts hold low-privileged administrative credentials. Operators of single-node deployments should prioritize patching since exploitation would cause a full denial of network access for unauthenticated endpoints.