Cisco ISE: Critical security vulnerability despite required admin rights

Network admins using Cisco products should promptly install the recently released security updates for Identity Services Engine (ISE), ISE Passive Identity Connector (ISE-PIC), Webex App, Umbrella Virtual Appliance, and Crosswork Network Controller. Otherwise, attackers may be able to execute malicious code and compromise systems under certain conditions.

So far, the network equipment manufacturer has reported no ongoing attacks.

The most dangerous is a security vulnerability (CVE-2026-20181) in ISE and ISE-PIC. Despite the requirement that attackers must have admin rights, the vulnerability is classified as " critical ". If this is the case, they can initiate attacks with prepared HTTP requests and subsequently elevate themselves to root user. Subsequently, among other things, malicious code can get onto systems.

Via the Webex App vulnerability (CVE-2026-20178 " medium "), attackers can redirect victims to a website they control without authentication. The vulnerability (CVE-2026-20246 " medium ") in Umbrella Virtual Appliance grants attackers higher privileges. Crosswork Network Controller is vulnerable to malicious code commands (CVE-2026-20220 " medium ").

Admins can find further information on the vulnerabilities and repaired versions in the official security advisories:

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.