ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Cisco Identity Services Engine”

46 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 80Ransomware 47Exploit / PoC 41Malware 40Data breach 24Advisory 17Phishing & fraud 15Industry 14Threat actor 12Policy & legal 6AI safety & security 3Research 2AI tools & infra 2Tools 1
SeverityAllcritical 170high 65medium 46low 8info 16

ZDI-26-581: Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability

ZDI details CVE-2026-20147, an authenticated command injection in Cisco Identity Services Engine allowing remote code execution, rated CVSS 7.2.

ZDI-26-581 describes a command injection flaw in Cisco Identity Services Engine reachable through the invokeScript function. Remote attackers who authenticate can execute arbitrary code on affected installations. The issue is tracked as CVE-2026-20147 and carries a CVSS rating of 7.2. No exploitation activity is reported in the advisory.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-20147

ZDI-26-579: Cisco Identity Services Engine zipFiles Directory Traversal Remote Code Execution Vulnerability

ZDI disclosed an authenticated directory traversal flaw (CVE-2026-20181) in Cisco Identity Services Engine allowing remote code execution, CVSS 7.2.

The Zero Day Initiative published ZDI-26-579 describing a directory traversal in the zipFiles functionality of Cisco Identity Services Engine. Authenticated remote attackers can execute arbitrary code on affected installations. ZDI assigned a CVSS score of 7.2 and the identifier CVE-2026-20181.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-20181

ZDI-26-580: Cisco Identity Services Engine Missing Authentication for Critical Function Information Disclosure Vulnerability

ZDI discloses CVE-2026-20190, a missing-authentication flaw in Cisco Identity Services Engine permitting unauthenticated sensitive information disclosure, rated CVSS 7.5.

ZDI-26-580 covers a missing authentication for critical function flaw in Cisco Identity Services Engine. Unauthenticated remote attackers can disclose sensitive information from affected installations. The vulnerability is tracked as CVE-2026-20190 and rated CVSS 7.5. The advisory does not indicate exploitation in the wild.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-20190

Cisco Identity Services Engine Authentication Bypass Vulnerabilities

Cisco fixed multiple authentication bypass flaws in Identity Services Engine and ISE-PIC enabling remote data access, manipulation, and certificate material disruption.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on affected devices. Cisco has released software updates, and no workarounds are available. The advisory is part of Cisco's September 2026 publication batch.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine Vulnerabilities

Cisco patched ISE and ISE-PIC flaws enabling REST API authentication bypass, remote code execution, SQL injection, and XXE attacks.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks. Cisco has released software updates; no workarounds address these vulnerabilities.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine 802.1X Session Hijack and Information Disclosure Vulnerabilities

Cisco patched Identity Services Engine flaws letting unauthenticated local attackers bypass 802.1X authentication or disclose sensitive information.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an unauthenticated local attacker to conduct an authentication bypass involving 802.1X session hijack or disclose sensitive information. Cisco has released software updates addressing these vulnerabilities. No workarounds are available. The advisory is part of a batch of Cisco releases.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine SQL Injection Vulnerabilities

Cisco released fixes for multiple SQL injection vulnerabilities in Identity Services Engine as part of its September 2026 advisory batch.

Multiple SQL injection vulnerabilities in Cisco Identity Services Engine (ISE) could allow a remote attacker to conduct SQL injection attacks against affected devices. Cisco has released software updates, and no workarounds address the flaws. The advisory is part of a group of advisories published in Cisco's September 2026 batch.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities

Cisco fixed multiple authenticated SQL and HQL injection flaws in Identity Services Engine and ISE-PIC APIs allowing arbitrary database queries and unauthorized data access.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE-PIC stem from insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated, remote attacker can send crafted requests to execute arbitrary SQL or HQL queries against the underlying database, viewing or modifying data they are not authorized to access. Cisco has released software updates.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine Remote Code Execution Vulnerabilities

Cisco patched multiple authenticated remote code execution vulnerabilities in Identity Services Engine that require valid administrative credentials.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow an authenticated remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system. Cisco has released software updates; no workarounds address these vulnerabilities. The advisory is part of a batch of ISE releases.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine RADIUS Denial of Service Vulnerability

Cisco patched a RADIUS flaw in Identity Services Engine letting unauthenticated remote attackers trigger denial of service on ISE nodes.

A vulnerability in the RADIUS feature of Cisco Identity Services Engine allows an unauthenticated remote attacker to cause a denial of service by sending crafted RADIUS requests directly to an affected device. The flaw stems from improper handling of certain RADIUS requests and can render ISE nodes unavailable. In single-node deployments, endpoints that have not yet authenticated would be unable to access the network until the node recovers. Cisco has released software updates addressing the issue.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities

Cisco ISE and ISE-PIC contain multiple path traversal vulnerabilities allowing remote attacks; fixes released with no workarounds available.

Multiple path traversal vulnerabilities in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to conduct path traversal attacks on affected devices. Cisco has released software updates that address these vulnerabilities, and no workarounds are available. The advisory is part of a grouped set of September 2026 ISE advisories.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine Command Injection Vulnerabilities

Authenticated attackers with admin credentials could exploit Cisco ISE command injection flaws to execute arbitrary commands as root; fixes released.

Multiple command injection vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as the root user. Cisco has released software updates, and no workarounds are available. The advisory is part of a grouped set of September 2026 ISE advisories.

Cisco Security Advisories · 13h agoAdvisory 15 sources

Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities

Cisco fixed ISE vulnerabilities enabling authenticated SQL injection and OS command execution; CVE-2026-20282 and CVE-2026-20283 rated High.

Multiple Cisco Identity Services Engine vulnerabilities allow an authenticated remote attacker to conduct SQL injection, modify data, or execute arbitrary commands on the underlying OS. Cisco assigned a Security Impact Rating of High to CVE-2026-20282 and CVE-2026-20283 because attackers can easily reach root from the achieved privilege level. Software updates are available and a workaround addresses one of the vulnerabilities.

Cisco Security Advisories · 13h agoAdvisory 15 sourcesCVE-2026-20282CVE-2026-20283

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 15d agoMalware in the wild

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News · 15d agoThreat actor in the wild

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker News · 20d agoThreat actor in the wildCVE-2022-0995CVE-2021-3156CVE-2015-5287+8 CVEs