ZDI-26-716: Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability

Cisco ISE contains a command injection flaw (CWE-77) caused by insufficient validation of user-supplied input. An authenticated, remote attacker who already holds valid high-privileged administrative credentials can send a crafted HTTP request to an affected device to run arbitrary commands on the underlying operating system, gaining system-level access and then elevating to root. In single-node deployments, successful exploitation can render the ISE node unavailable, causing a denial of service in which endpoints that have not yet authenticated cannot access the network until the node is restored. All Cisco ISE deployments are potentially affected, though exploitation requires stolen or compromised administrator credentials rather than anonymous access. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation has not been confirmed.

Do: Upgrade to the fixed release specified in Cisco's PSIRT advisory for CVE-2026-20176 (not listed in this data). Until patched, restrict access to the ISE administration interface to trusted management networks, audit high-privileged admin accounts for compromise (since valid admin credentials are required), and monitor for unexpected root-level or shell activity on ISE appliances. Operators of single-node deployments should prepare failover/restore plans, as exploitation would block new endpoint network authentication until the node is recovered.