CVE-2026-20211

Cisco Identity Services Engine Remote Code Execution Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.1Critical EPSS percentile44th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run cisco identity services engine software and identify its installed release and all administrator accounts.
Restrict high-privileged administrator access to trusted staff and management networks; review and disable unneeded administrator accounts.
No fixed version is currently available in the findings; ask Cisco or your support provider for the applicable update and deploy it as soon as one is issued.
Review administrator logins and ISE server activity for unexpected changes or command execution.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

In plain language

Written by AI from the record

If you run cisco identity services engine software, this is a serious flaw that can let someone with a high-level administrator account take control of the server; treat it as urgent.

Authenticated remote code execution in cisco identity services engine software through insecure Java object deserialization, requiring valid high-privileged administrative credentials and potentially leading to root access.

If you're affected

Full ISE server takeover
Network access outages
Authentication disruption
Administrative credential abuse
Policy enforcement disruption

What is it

This weakness lets an attacker who has a powerful administrator account send specially made information to the server and run their own commands. It is like giving someone with a master key access to the building’s control room: they could take over operations or make the system unavailable.

Who is affected

This matters to you if you use or run cisco identity services engine software. It is only a risk if an attacker already has valid high-privileged administrator credentials.

How urgent is it

A public exploit is available, giving attackers a ready-made path to target this flaw. Treat this as a red-priority issue: immediately limit powerful administrator access while awaiting Cisco’s fix guidance.

What to do — in detail

Confirm whether cisco identity services engine software is deployed, record the installed release for each node, and identify single-node deployments because a successful attack can make the node unavailable and prevent unauthenticated endpoints from accessing the network. The findings do not provide affected-version ranges or fixed versions, so obtain the applicable release guidance directly from Cisco or your support provider before scheduling an upgrade.

Until a vendor fix is available, restrict high-privileged administrative access to a tightly controlled management network, remove unnecessary administrator accounts, rotate credentials where compromise is suspected, and investigate unexpected administrator logins, configuration changes, or operating-system command activity. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CVSS 9.1 Critical. The vulnerability is CWE-502 insecure deserialization of Java objects: a remote, authenticated attacker with high-privileged administrative credentials can submit a crafted serialized Java object and execute arbitrary operating-system commands, obtain user-level access, and potentially elevate to root. A public exploit is available; CISA KEV does not list this CVE. EPSS is 0.6% (45th percentile) with a flat trend. In a single-node deployment, successful exploitation can cause denial of service that blocks endpoints not already authenticated.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS44th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 44th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 1 day, from the signal feeds we watch.

2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Identity Services Engine SoftwareNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable