ZDI-26-581: Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability
ZDI details CVE-2026-20147, an authenticated command injection in Cisco Identity Services Engine allowing remote code execution, rated CVSS 7.2.
ZDI-26-581 describes a command injection flaw in Cisco Identity Services Engine reachable through the invokeScript function. Remote attackers who authenticate can execute arbitrary code on affected installations. The issue is tracked as CVE-2026-20147 and carries a CVSS rating of 7.2. No exploitation activity is reported in the advisory.
- Authenticated command injection via invokeScript enables remote code execution
- CVSS 7.2; tracked as CVE-2026-20147
- Affects Cisco Identity Services Engine deployments
- CVEs
- CVE-2026-20147
- Vendors
- CiscoZero Day Initiative
- Products
- Cisco Identity Services Engine
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20147 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system… | 9.9 | 12% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.