CVE-2026-20136

Summary

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying operating system and elevate privileges to root.

This vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by providing crafted input to a specific CLI command. A successful exploit could allow the attacker to elevate their privileges to root on the underlying operating system.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Identity Services Engine Software3.1.0affected
CiscoCisco Identity Services Engine Software3.1.0 p1affected
CiscoCisco Identity Services Engine Software3.1.0 p3affected
CiscoCisco Identity Services Engine Software3.1.0 p2affected
CiscoCisco Identity Services Engine Software3.2.0affected
CiscoCisco Identity Services Engine Software3.1.0 p4affected
CiscoCisco Identity Services Engine Software3.1.0 p5affected
CiscoCisco Identity Services Engine Software3.2.0 p1affected
CiscoCisco Identity Services Engine Software3.1.0 p6affected
CiscoCisco Identity Services Engine Software3.2.0 p2affected
CiscoCisco Identity Services Engine Software3.1.0 p7affected
CiscoCisco Identity Services Engine Software3.3.0affected
CiscoCisco Identity Services Engine Software3.2.0 p3affected
CiscoCisco Identity Services Engine Software3.2.0 p4affected
CiscoCisco Identity Services Engine Software3.1.0 p8affected
CiscoCisco Identity Services Engine Software3.2.0 p5affected
CiscoCisco Identity Services Engine Software3.2.0 p6affected
CiscoCisco Identity Services Engine Software3.1.0 p9affected
CiscoCisco Identity Services Engine Software3.3 Patch 2affected
CiscoCisco Identity Services Engine Software3.3 Patch 1affected
CiscoCisco Identity Services Engine Software3.3 Patch 3affected
CiscoCisco Identity Services Engine Software3.4.0affected
CiscoCisco Identity Services Engine Software3.2.0 p7affected
CiscoCisco Identity Services Engine Software3.3 Patch 4affected
CiscoCisco Identity Services Engine Software3.4 Patch 1affected
CiscoCisco Identity Services Engine Software3.1.0 p10affected
CiscoCisco Identity Services Engine Software3.3 Patch 5affected
CiscoCisco Identity Services Engine Software3.3 Patch 6affected
CiscoCisco Identity Services Engine Software3.4 Patch 2affected
CiscoCisco Identity Services Engine Software3.3 Patch 7affected
CiscoCisco Identity Services Engine Software3.4 Patch 3affected
CiscoCisco Identity Services Engine Software3.5.0affected
CiscoCisco Identity Services Engine Software3.4 Patch 4affected
CiscoCisco Identity Services Engine Software3.3 Patch 8affected
CiscoCisco Identity Services Engine Software3.2 Patch 8affected
CiscoCisco Identity Services Engine Software3.5 Patch 1affected
CiscoCisco Identity Services Engine Software3.3 Patch 9affected
CiscoCisco Identity Services Engine Software3.2 Patch 9affected
CiscoCisco Identity Services Engine Software3.4 Patch 5affected
CiscoCisco Identity Services Engine Software3.5 Patch 2affected
CiscoCisco Identity Services Engine Software3.3 Patch 10affected

Weaknesses

  • CWE-116: Improper Encoding or Escaping of Output

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References