ThreatCluster

Cisco Identity Services Engine Vulnerabilities Lead to Remote Code Execution Risks

First seen 16 Sep 2026, 16:30 UTC • •73

Article Content

1 / 16

Browse articles

ThreatCluster •September 16, 2026 at 16:33 UTC

•Multiple vulnerabilities in Cisco ISE allow remote code execution and SQL injection.
•Cisco has released patches but no workarounds are available for affected systems.
•Vulnerabilities include CVE-2026-20282 and CVE-2026-76423, impacting various configurations.

Multiple vulnerabilities have been identified in Cisco Identity Services Engine (ISE) and its Passive Identity Connector (ISE-PIC), allowing authenticated remote attackers to execute arbitrary commands, perform SQL injections, and bypass authentication. Key CVEs include CVE-2026-20282, CVE-2026-20283, and CVE-2026-76423, among others. These vulnerabilities affect various configurations of Cisco ISE, with some allowing unauthenticated access. Cisco has released software updates to address these vulnerabilities, but no workarounds are available. The vulnerabilities are due to insufficient input validation and improper handling of requests, posing significant risks to affected systems. The advisories were published on September 16, 2026, and are part of a broader set of vulnerabilities disclosed by Cisco.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-16

Cisco ISE vulnerabilities disclosed

Cisco published advisories detailing multiple vulnerabilities in ISE and ISE-PIC, including remote code execution risks.

Sec.Cloudapps.Cisco

2026-09-16

Patches released for vulnerabilities

Cisco released software updates to address the vulnerabilities in ISE and ISE-PIC, urging users to apply them immediately.

Sec.Cloudapps.Cisco

2026-09-16

Vulnerabilities classified as high severity

Cisco assigned a high security impact rating to CVE-2026-20282 and CVE-2026-20283 due to the ease of achieving root access.

Sec.Cloudapps.Cisco

More articles in this cluster (15)

Following this threat?

Track Cisco and CVE-2026-20071 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…