CVE-2026-20186
Full vulnerability record from the local CVENow database.
Description
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Severity
CRITICAL
CVSS score
9.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-15 17:17:03.933000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-20186",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T17:17:03.933",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored."
},
{
"lang": "es",
"value": "Una vulnerabilidad en Cisco Identity Services Engine (ISE) podría permitir a un atacante remoto y autenticado ejecutar comandos arbitrarios en el sistema operativo subyacente de un dispositivo afectado. Para explotar esta vulnerabilidad, el atacante debe tener al menos credenciales de administrador de solo lectura.\n\nEsta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario. Un atacante podría explotar esta vulnerabilidad enviando una solicitud HTTP manipulada a un dispositivo afectado. Un exploit exitoso podría permitir al atacante obtener acceso a nivel de usuario al sistema operativo subyacente y luego elevar privilegios a root. En implementaciones de ISE de nodo único, la explotación exitosa de estas vulnerabilidades podría causar que el nodo ISE afectado deje de estar disponible, lo que resultaría en una condición de denegación de servicio (DoS). En esa condición, los puntos finales que aún no se han autenticado no podrían acceder a la red hasta que se restaure el nodo."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Identity Services Engine Software",
"defaultStatus": "unknown",
"versions": [
{
"version": "3.1.0",
"status": "affected"
},
{
"version": "3.1.0 p1",
"status": "affected"
},
{
"version": "3.1.0 p3",
"status": "affected"
},
{
"version": "3.1.0 p2",
"status": "affected"
},
{
"version": "3.2.0",
"status": "affected"
},
{
"version": "3.1.0 p4",
"status": "affected"
},
{
"version": "3.1.0 p5",
"status": "affected"
},
{
"version": "3.2.0 p1",
"status": "affected"
},
{
"version": "3.1.0 p6",
"status": "affected"
},
{
"version": "3.2.0 p2",
"status": "affected"
},
{
"version": "3.1.0 p7",
"status": "affected"
},
{
"version": "3.3.0",
"status": "affected"
},
{
"version": "3.2.0 p3",
"status": "affected"
},
{
"version": "3.2.0 p4",
"status": "affected"
},
{
"version": "3.1.0 p8",
"status": "affected"
},
{
"version": "3.2.0 p5",
"status": "affected"
},
{
"version": "3.2.0 p6",
"status": "affected"
},
{
"version": "3.1.0 p9",
"status": "affected"
},
{
"version": "3.3 Patch 2",
"status": "affected"
},
{
"version": "3.3 Patch 1",
"status": "affected"
},
{
"version": "3.3 Patch 3",
"status": "affected"
},
{
"version": "3.4.0",
"status": "affected"
},
{
"version": "3.2.0 p7",
"status": "affected"
},
{
"version": "3.3 Patch 4",
"status": "affected"
},
{
"version": "3.4 Patch 1",
"status": "affected"
},
{
"version": "3.1.0 p10",
"status": "affected"
},
{
"version": "3.3 Patch 5",
"status": "affected"
},
{
"version": "3.3 Patch 6",
"status": "affected"
},
{
"version": "3.4 Patch 2",
"status": "affected"
},
{
"version": "3.3 Patch 7",
"status": "affected"
},
{
"version": "3.4 Patch 3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T00:00:00+00:00",
"id": "CVE-2026-20186",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0",
"matchCriteriaId": "68181711-C28D-4464-8C67-0A4FA0F338BF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*",
"matchCriteriaId": "7932D5D5-83E1-4BEF-845A-D0783D4BB750"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*",
"matchCriteriaId": "1B818846-4A6E-4256-B344-281E8C786C43"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*",
"matchCriteriaId": "A44858A2-922A-425A-8B38-0C47DB911A3C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*",
"matchCriteriaId": "53484A32-757B-42F8-B655-554C34222060"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*",
"matchCriteriaId": "0CCAC61F-C273-49B3-A631-31D3AE3EB148"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*",
"matchCriteriaId": "51AEFCE6-FB4A-4B1C-A23D-83CC3CF3FBBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*",
"matchCriteriaId": "B452B4F0-8510-475E-9AE8-B48FABB4D7D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:*",
"matchCriteriaId": "5733512D-12B5-4098-AF90-9D68217FAC27"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "F1B9C2C1-59A4-49A0-9B74-83CCB063E55D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*",
"matchCriteriaId": "DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*",
"matchCriteriaId": "E6C94CC4-CC08-4DAF-A606-FDAFC92720A9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*",
"matchCriteriaId": "BB069EA3-7B8C-42B5-8035-2EE5ED3F56E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*",
"matchCriteriaId": "FF8B81A6-BF44-4E5F-B167-39F61DDCA026"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*",
"matchCriteriaId": "56E0F0EC-3E66-4866-89F5-89B331F3F517"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*",
"matchCriteriaId": "2E3E8937-2859-4A2A-91C0-05F674EF0466"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:*",
"matchCriteriaId": "D4B14684-EB9E-405B-85FA-B62E57CB292C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D23905E0-E525-49B1-8E5F-4EB42D186768"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*",
"matchCriteriaId": "74509498-38EF-4345-9583-CEF5C26CA1D8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:*",
"matchCriteriaId": "CD05FF93-7B8C-4283-9DB7-E03FE98FAADF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:*",
"matchCriteriaId": "0F9B6A8E-E773-44A3-9266-878F0C58EB41"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}