Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

CVE-2026-20130 covers a set of internally discovered improper neutralization of special elements issues (CWE-74, the injection class of weaknesses) in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC), found during a comprehensive internal security review and addressed in a software hardening release. Per the CVSS vector, the flaws are remotely exploitable by an unauthenticated attacker with no user interaction required (AV:N/AC:L/PR:N). Successful exploitation carries high impact on confidentiality, integrity, and availability with scope change, meaning an attacker could potentially break out beyond the vulnerable component to compromise additional system scope. Any organization running Cisco ISE or ISE-PIC for network access control or passive identity services is potentially affected. There is currently no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA's KEV.

Do: Apply the Cisco ISE software hardening release referenced in the PSIRT advisory as soon as practical, checking the advisory for the exact fixed release for your ISE/ISE-PIC train since versions are not specified here. In the interim, restrict administrative and API-facing interfaces of ISE (Admin portal, pxGrid, related services) to trusted management networks and review logs for unexpected unauthenticated requests. Include hosts running ISE-PIC (typically Windows domain controllers) in the patch and monitoring plan.

Cisco ISE contains a command injection flaw (CWE-77) caused by insufficient validation of user-supplied input. An authenticated, remote attacker who already holds valid high-privileged administrative credentials can send a crafted HTTP request to an affected device to run arbitrary commands on the underlying operating system, gaining system-level access and then elevating to root. In single-node deployments, successful exploitation can render the ISE node unavailable, causing a denial of service in which endpoints that have not yet authenticated cannot access the network until the node is restored. All Cisco ISE deployments are potentially affected, though exploitation requires stolen or compromised administrator credentials rather than anonymous access. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation has not been confirmed.

Do: Upgrade to the fixed release specified in Cisco's PSIRT advisory for CVE-2026-20176 (not listed in this data). Until patched, restrict access to the ISE administration interface to trusted management networks, audit high-privileged admin accounts for compromise (since valid admin credentials are required), and monitor for unexpected root-level or shell activity on ISE appliances. Operators of single-node deployments should prepare failover/restore plans, as exploitation would block new endpoint network authentication until the node is recovered.

CVE-2026-20282 is a vulnerability in Cisco Identity Services Engine (ISE) caused by insufficient validation of user-supplied input. An attacker who already has valid administrative credentials can send a crafted HTTP request to an affected device and obtain write access to the underlying operating system. Cisco rated the flaw High despite the Medium CVSS score because an attacker can easily escalate from the achieved privilege level to root, effectively yielding full control of the appliance. Any organization running Cisco ISE is affected, though exploitation requires both network reachability to the device and stolen or malicious administrator credentials. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

Do: Review Cisco's advisory for CVE-2026-20282 and upgrade ISE to the fixed release it specifies, prioritizing the fix since Cisco rates the impact High due to the easy path to root. Restrict ISE administration interfaces to dedicated management networks and enforce strong credential hygiene/MFA for ISE admin accounts, since valid admin credentials are required for exploitation. Check ISE admin and audit logs for unexpected administrative sessions or unusual HTTP requests to management endpoints.

Cisco Identity Services Engine (ISE) contains an operating system command injection flaw (CWE-78) in its IPsec Open API endpoint, caused by insufficient validation of user-supplied input in IPsec Open API calls. An authenticated, remote attacker who holds valid administrative credentials can send crafted input to the endpoint to execute arbitrary commands on the underlying operating system. Exploitation additionally requires the ISE node to have more than one network interface, one of which is configured as an active IPsec tunnel. Although the CVSS 3.1 base score is 6.5 (Medium), Cisco assigned a Security Impact Rating of High because it is easy to escalate from the achieved privilege level to root. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade ISE to the fixed release identified in Cisco's advisory; the related-headline bundle indicates companion ISE RCE/API vulnerabilities fixed at the same time, so apply the full set of patches. Until patching, restrict access to the Open API to trusted management networks, disable the Open API or IPsec tunnel configuration where unused, and limit and rotate administrative credentials. Audit ISE deployments for multi-interface nodes with active IPsec tunnels, as those are the exploitable targets.

Cisco ISE (Identity Services Engine) contains a SQL injection flaw (CWE-943) in its SXP REST API, caused by insufficient validation of user-supplied input in REST API calls. To trigger it, an attacker must send crafted input to the affected device while holding valid administrative credentials, with the SXP service enabled and at least one SXP connection configured. A successful exploit could let the attacker read or modify data in the underlying ISE database, and in single-node deployments could crash the node, denying network access to endpoints that have not yet authenticated. Any organization running Cisco ISE with SXP/TrustSec in this configuration is affected, though the admin-credential requirement makes insider or compromised-credential scenarios the primary risk. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not in CISA's KEV catalog.

Do: Upgrade ISE nodes to the fixed release identified in Cisco's security advisory (not specified in the source data). As interim mitigation, restrict access to the ISE admin/REST API to trusted management networks, disable the SXP service on nodes that do not use it, and audit admin accounts for credential compromise. Monitor Cisco PSIRT for updated fixed-version guidance.

A command injection flaw (CWE-78) exists in the diagnostic tools of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), caused by improper validation of user-supplied input. An authenticated remote attacker who already holds valid administrative credentials can send crafted commands through the web-based management interface to inject commands into the underlying operating system. A successful exploit yields arbitrary code execution and elevation to root on the affected node. Organizations running ISE or ISE-PIC are affected; in single-node deployments, exploitation can render the ISE node unavailable, blocking endpoints that have not yet authenticated from accessing the network. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation has not been confirmed.

Do: Upgrade ISE and ISE-PIC nodes to the fixed releases identified in the Cisco security advisory for CVE-2026-20305, as no workaround is described in the available data. Because valid admin credentials are required, restrict access to the web-based management interface, review and rotate administrative credentials, and audit admin activity logs for unexpected diagnostic-tool commands. Treat single-node deployments as higher risk given the potential denial-of-service impact on network access.

Cisco ISE and ISE-PIC contain a command injection vulnerability (CWE-78) in their REST API, caused by improper validation of user-supplied input. An authenticated, remote attacker who already holds valid administrative credentials can send crafted commands to the web-based management interface to trigger the flaw. Successful exploitation allows arbitrary code execution on the underlying operating system with elevation to root privileges. In single-node deployments, exploitation can also render the ISE node unavailable, denying network access to endpoints that have not yet authenticated. As of the latest data, the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

Do: Upgrade ISE and ISE-PIC to the fixed releases identified in the Cisco Security Advisory (version numbers not provided in available data). Until patched, restrict access to the management and REST API interfaces to trusted admin networks, audit and rotate privileged administrative credentials (since valid admin creds are required for exploitation), and enable MFA for ISE administrators. Organizations running single-node deployments should prioritize patching and maintain backups, as exploitation could take the sole node offline and block new endpoint authentication.

Cisco Identity Services Engine (ISE) contains an insecure deserialization flaw (CWE-502) in its web-based management interface, caused by unsafe handling of a user-supplied Java byte stream. An attacker who already holds at least low-privileged administrative credentials can send a crafted serialized Java object to the management interface to trigger the flaw. Successful exploitation yields arbitrary code execution on the underlying operating system and privilege escalation to root; in single-node deployments it can also render the ISE node unavailable, blocking network access for endpoints that have not yet authenticated. All Cisco ISE deployments whose management interface is reachable by an attacker with administrative credentials are affected, though specific version ranges were not provided in the source data. As of now the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

Do: Upgrade affected ISE nodes to the fixed release identified in Cisco's advisory. Until patched, restrict access to the ISE web management interface to trusted administrative networks and audit which accounts hold low-privileged administrative credentials. Operators of single-node deployments should prioritize patching since exploitation would cause a full denial of network access for unauthenticated endpoints.

CVE-2026-20322 covers multiple improper access control vulnerabilities (CWE-284) in Cisco Nexus Dashboard that were found by Cisco's own engineering team during an internal security review and fixed in a software hardening release. Per the CVSS vector, exploitation requires network access and valid low-privileged credentials (AV:N/PR:L), with no user interaction, and because the scope is changed (S:C), a successful attacker can cross a security boundary to gain high-privileged access to data and functions (confidentiality, integrity, and availability all rated high). In practical terms, an attacker with any low-level authenticated account — such as a guest or limited operator account — could bypass intended access restrictions on the management platform that centralizes control of Cisco data center fabrics. All organizations running affected Cisco Nexus Dashboard deployments are in scope. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no exploitation has been reported; specific affected and fixed version ranges are not included in the available data and must be taken from the Cisco advisory.

Do: Check the Cisco PSIRT advisory for CVE-2026-20322 to identify whether your Nexus Dashboard release is affected and upgrade to the software hardening release it specifies. Because exploitation requires low-privileged credentials, audit the platform for unnecessary or shared low-privilege user accounts and API keys, remove them, and restrict access to the Nexus Dashboard management interface to trusted admin networks. No public PoC or in-the-wild exploitation is known, so treat this as a high-priority routine patch rather than an emergency.

CVE-2026-20329 tracks multiple vulnerabilities in Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software, all involving improper handling of exceptional conditions (CWE-703 pillar) and discovered during a comprehensive internal Cisco security review. Cisco is addressing them through a software hardening release rather than describing individual exploitation paths, so the exact trigger conditions per flaw are not itemized in the available data. The CVSS 9.9 (critical) score with AV:N/AC:L/PR:L/UI:N/S:C indicates the flaws are reachable over the network, without user interaction, by an attacker who already holds valid low-privileged credentials (for example, a VPN user or low-privileged management account), and that successful exploitation can affect resources beyond the vulnerable component with high impact to confidentiality, integrity, and availability. Any organization running Cisco ASA, FTD, or FMC is potentially affected, with edge firewalls (ASA/FTD) representing the largest exposed population. Exploitation status: no entry in CISA KEV, no public proof-of-concept, and no known in-the-wild exploitation as of this analysis.

Do: Review the Cisco PSIRT advisory for CVE-2026-20329 to identify affected releases for your ASA, FTD, and FMC deployments and upgrade to the software hardening release it specifies. Because the CVSS vector indicates a low-privileged authenticated attacker is required, enforce multi-factor authentication on VPN and management access, rotate VPN user and administrative credentials, and restrict management interface exposure to trusted networks. The CVE description is generic, so monitor Cisco PSIRT for expanded detail and updated fixed-version lists.

Cisco ISE and Cisco ISE-PIC contain an authentication bypass (CWE-290) in their REST API web service, which is exposed with insufficient authorization checks. An unauthenticated, remote attacker can exploit it by sending a crafted HTTP request to the exposed REST API port, requiring no credentials or user interaction. A successful exploit grants administrative privileges over the device, letting the attacker read and modify ISE configuration and identity data. Any organization running an affected Cisco ISE or ISE-PIC deployment is affected, with risk highest where the REST API port is reachable from untrusted networks. No public proof-of-concept or in-the-wild exploitation is currently known, and the flaw is not yet listed in CISA's KEV catalog.

Do: Upgrade ISE and ISE-PIC to the fixed releases identified in the Cisco PSIRT advisory for CVE-2026-76423. As an interim mitigation, restrict network access to the ISE REST API port to trusted management networks and disable the REST API service where it is not required. Review ISE logs for unauthenticated or anomalous administrative API requests, and treat configuration and identity data on exposed deployments as potentially compromised.

Cisco Identity Services Engine (ISE) contains a path traversal flaw (CWE-23) in its REST API caused by insufficient validation of file operations. An attacker who already holds valid administrative credentials can send an API request uploading a file with a crafted path, allowing the file to be written to arbitrary locations on the device. Successful exploitation lets the attacker upload files anywhere on the appliance and execute arbitrary commands with root privileges, giving full compromise of the ISE deployment. Because high privileges are required, the flaw is rated CVSS 3.1 7.2 (High) with AV:N/AC:L/PR:H. It is not currently listed in CISA's KEV catalog and no public proof-of-concept or in-the-wild exploitation is known.

Do: Upgrade ISE to the fixed releases listed in the Cisco PSIRT advisory for CVE-2026-76424. Until patched, restrict access to the ISE REST API to trusted management networks, audit privileged/administrative accounts for compromise, and review API logs for file-upload requests containing path traversal characters (e.g., ../ sequences).

Cisco Identity Services Engine (ISE) contains a SQL injection flaw in its APIs caused by insufficient validation of parameters that are concatenated directly into backend database queries. An attacker who sends a specially crafted request containing SQL statements to an affected API endpoint can trigger the flaw, but valid administrative credentials are required to do so. A successful exploit allows the attacker to read arbitrary content from the SQL database and to conduct server-side request forgery (SSRF) attacks. All organizations running affected releases of Cisco ISE are potentially affected, though exploitation requires a privileged attacker account. As of now there is no evidence of in-the-wild exploitation and no public proof-of-concept is known, and the flaw is not listed in CISA's KEV catalog.

Do: Check the Cisco PSIRT advisory for CVE-2026-76425 and upgrade ISE to a fixed release as soon as one is identified. Because exploitation requires valid administrative credentials, restrict access to the ISE admin and API interfaces to trusted management networks, enforce strong authentication and least privilege for admin accounts, and audit/rotate administrative credentials. Monitor API logs for unexpected queries and outbound requests that could indicate attempted SSRF.

CVE-2026-76426 is a SQL injection flaw (CWE-89) in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC (Passive Identity Connector), caused by insufficient validation of specific parameters that are concatenated into an SQL statement targeting the monitoring database. An attacker triggers it by sending a crafted REST API request containing SQL statements in one of the affected parameters, but must already hold valid administrative credentials. A successful exploit allows the attacker to read information from the monitoring database, with confidentiality impact only (CVSS 3.1 score of 4.9, medium). All organizations running ISE or ISE-PIC are potentially affected, though exploitation requires high-privilege access. No public proof-of-concept or confirmed exploitation of this specific flaw is known; however, related reporting describes a separate, actively exploited Cisco ISE zero-day authentication bypass (CVSS 10.0), so ISE administrators should patch urgently.

Do: Upgrade ISE and ISE-PIC to the fixed releases identified in Cisco's advisory (version numbers not provided in the available data). Since exploitation requires valid administrative credentials, restrict and audit admin accounts, limit REST API access to trusted management networks, and review monitoring-database query and REST API logs for anomalous SQL content. Also monitor for the separately reported, actively exploited ISE authentication zero-day and check systems for signs of compromise.

Cisco ISE contains an XML external entity (XXE) injection flaw (CWE-611) in its offline profiler feed service, caused by parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with valid administrative credentials can exploit it by uploading a crafted offline feed package through the administrative interface. Successful exploitation allows the attacker to read arbitrary files from the device's file system and issue requests to internal systems from the ISE appliance (server-side request forgery), though confidentiality-only impact gives it a medium CVSS 4.9. All organizations running Cisco ISE are potentially affected, but exploitation requires administrative access to the management interface, which is typically restricted to internal management networks. No public proof-of-concept or confirmed exploitation of this specific flaw is known, although Cisco has separately warned that another ISE zero-day (an auth bypass rated CVSS 10.0) is being actively exploited, so ISE deployments are currently under attacker attention.

Do: Upgrade ISE to the fixed release identified in the Cisco security advisory once published, as no fixed version is listed in the available data. Restrict access to the ISE administrative interface to trusted management networks and review logs for unexpected offline feed package uploads or outbound requests originating from ISE appliances. Given that a separate, actively exploited ISE zero-day (CVSS 10.0 auth bypass) has been announced, treat ISE patching as an urgent priority and verify all ISE nodes in the deployment are updated.

Cisco ISE and Cisco ISE-PIC contain a SQL injection flaw (CWE-89) in their REST APIs, where certain parameters are concatenated directly into SQL clauses without parameterization. An authenticated remote attacker who already holds valid administrative credentials can send a crafted request containing SQL statements in one of the affected parameters. A successful exploit allows the attacker to read information from the session database, with no integrity or availability impact, which is why the CVSS 3.1 score is a moderate 4.9 despite network reachability. All organizations running affected Cisco ISE or ISE-PIC releases are potentially affected, though exploitation requires high-privilege access. No public proof-of-concept or confirmed exploitation of this specific SQL injection is known, but Cisco ISE is drawing attacker attention because a separate ISE authentication-bypass zero-day (CVSS 10.0) is reportedly being exploited in active attacks.

Do: Update ISE and ISE-PIC to the fixed releases identified in Cisco's security advisory once published, since no workaround details are available in the data. Restrict access to the ISE REST APIs to trusted administrative networks and hosts, and review which accounts hold administrative credentials. Given a separate ISE auth-bypass zero-day is under active exploitation, monitor Cisco PSIRT channels and authentication/API logs for anomalous activity closely.

Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending.

Do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface.

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.