CVE-2026-20181: Cisco Identity Services Engine Remote Code Execution Vulnerability

Synopsis

This is a remote code execution vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), reachable over the network by any attacker with valid administrative credentials. Exploitation is triggered by sending a crafted HTTP request, which first grants user-level operating system access and then allows privilege escalation to root. A successful attack gives the attacker full control of the underlying OS and, in single-node deployments, can render the ISE node unavailable and block unauthenticated endpoints from accessing the network. No fix has been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Cisco releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ISE administrative interface over the network; there is no local-only or physical-access constraint.

• AuthenticationRequired

  Valid administrative credentials are required; a standard low-privilege account is not sufficient, an admin-level account must be compromised or obtained first.

• Victim interactionNot required

  No action by any user or administrator on the target device is needed to complete the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other variable environmental factors beyond holding valid admin credentials.

Blast Radius

• The attacker gains an initial foothold as an OS-level user and then escalates privileges to root, achieving full control of the underlying operating system.
• With root access, the attacker can read all data processed by ISE, including authentication records, identity data, and network access policy configurations.
• The attacker can modify ISE configuration, policy rules, or stored credentials, allowing persistent backdoors or manipulation of who is granted network access.
• In single-node deployments, the attacker can crash or disable the ISE node, blocking any endpoint that has not yet authenticated from accessing the network until the node is restored.