ZDI-26-717: Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-20211, an authenticated deserialization flaw (CVSS 7.2) enabling remote code execution in Cisco Identity Services Engine.
ZDI-26-717 describes a deserialization of untrusted data vulnerability in Cisco Identity Services Engine's AlarmMessageDiskQueue that allows remote code execution. Exploitation requires valid authentication. The flaw is tracked as CVE-2026-20211 with a CVSS score of 7.2.
- Unsafe deserialization in AlarmMessageDiskQueue enables authenticated RCE
- CVSS 7.2; valid credentials required to exploit
- CVEs
- CVE-2026-20211
- Vendors
- CiscoZero Day Initiative
- Products
- Cisco Identity Services Engine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20211 | Authenticated Java Deserialization RCE in Cisco Identity Services Engine (ISE) | 9.1 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.