Critical Cisco ISE Vulnerabilities Expose Systems to SQL Injection and Command Execution

Redpacketsecurity

Critical Cisco ISE Vulnerabilities Expose Systems to SQL Injection and Command Execution

First seen 17 Sep 2026, 16:29 UTC • •57.8

Article Content

1 / 4

Browse articles

ThreatCluster •September 17, 2026 at 18:24 UTC

•CVE-2026-20300 allows SQL injection via crafted requests.
•CVE-2026-20307 enables remote command execution through insecure deserialization.
•Immediate remediation is recommended for affected Cisco ISE systems.

Two vulnerabilities in Cisco Identity Services Engine (ISE) have been disclosed: CVE-2026-20300 and CVE-2026-20307. CVE-2026-20300 allows authenticated attackers to conduct SQL injection attacks, potentially exposing sensitive data and altering network policies. CVE-2026-20307 enables remote command execution through insecure deserialization, risking denial of service and privilege escalation. Both vulnerabilities require low-privileged administrative credentials for exploitation. Organizations with exposed management interfaces are particularly at risk. No active exploitation has been confirmed, but remediation is strongly advised. Cisco has published a fixed software release for these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-16

CVE-2026-20300 published

Cisco disclosed a SQL injection vulnerability in Cisco ISE affecting authenticated users.

Redpacketsecurity

2026-09-16

CVE-2026-20307 published

Cisco disclosed a command execution vulnerability in Cisco ISE due to insecure deserialization.

2026-09-17

Remediation recommended

Cisco advises organizations to apply the fixed software release and restrict management access.

Redpacketsecurity

More articles in this cluster (3)

Threat Graph

12 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (6)

Sql Injection
Zero-day Exploit
T1059 - Command and Scripting Interpreter
T1078 - Valid Accounts
T1110 - Brute Force
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-20300

Weakness (4)

CWE-200 - Exposure of Sensitive Information
CWE-20 - Improper Input Validation
Cwe-502 - Deserialization Of Untrusted Data
Cwe-89 - SQL Injection

Affected Platform (1)

Cisco ISE

Relationships

CVE-2026-20300 targets Cisco ISE
Sql Injection targets Cisco ISE
Zero-day Exploit targets Cisco ISE
T1059 - Command and Scripting Interpreter targets Cisco ISE
T1078 - Valid Accounts targets Cisco ISE
T1110 - Brute Force targets Cisco ISE
T1190 - Exploit Public-Facing Application targets Cisco ISE
CVE-2026-20300 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-20300 related to CWE-20 - Improper Input Validation
CVE-2026-20300 related to Cwe-502 - Deserialization Of Untrusted Data
CVE-2026-20300 related to Cwe-89 - SQL Injection

Following this threat?

Track CVE-2026-20300 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…

Critical GitLab CVE-2026-85706 Exploited; Microsoft Issues Record 974 Patches A critical CVE-2026-85706 path-traversal vulnerability in GitLab (CVSS 10.0) was exploited in the wild just hours after its disclosure on September 12, 2026. Microsoft released its largest-ever patch batch, addressing 974 vulnerabilities, including several actively exploited Windows flaws. The GitLab flaw allows…