CVE-2026-20147 - Vulnerability Analysis

Overview

Cisco ISE and Cisco ISE-PIC contain a command injection caused by insufficient validation of user-supplied input in HTTP requests, letting authenticated remote attackers with admin credentials execute arbitrary OS commands and cause DoS.

Severity & Score

Impact

Authenticated attackers can execute arbitrary OS commands, escalate to root, and cause denial of service on single-node deployments.

Mitigation

Update to the latest Cisco ISE version with the fix applied.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner