CVE-2026-20283

A weakness in this identity-management system can allow an attacker who already has an administrator account to make the underlying server run their commands. It is like giving someone with a master key the ability to replace the building’s locks, read restricted files, and change the security rules.

This matters to you if you run Cisco Identity Services Engine Software. The risk applies when a node has more than one network interface and at least one active IPsec tunnel; the attacker must already have valid administrator credentials.

A public exploit is available, meaning attackers who obtain or misuse an administrator account have a practical route to take over the affected system. Treat this as urgent: restrict administrator access and the exposed feature now while you obtain Cisco’s fix guidance.

Confirm whether each Cisco Identity Services Engine Software node has multiple network interfaces and an active IPsec tunnel, then determine whether the IPsec Open API is reachable by accounts or networks beyond tightly controlled administrators. Review administrator-account creation, sign-in activity, and configuration changes for unexpected activity, and remove or disable unused privileged accounts.

No fixed versions or patch information are available in the findings. Contact Cisco support or your Cisco partner for the affected-release list, the first fixed release for your upgrade branch, and any required upgrade path or compatibility notes before scheduling the update.

If patching is delayed, restrict or disable IPsec Open API access where feasible, limit administrative access to approved management networks, and require strong authentication for all administrator accounts. Monitor for unusual administrator logins, unexpected IPsec configuration changes, and unexplained command or system-level activity. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so no CISA remediation due date is provided.

CVE-2026-20283 is rated CVSS 6.5 (Medium): AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The weakness is CWE-78 command injection caused by insufficient validation of user-supplied input in IPsec Open API calls. An authenticated remote attacker with valid administrative credentials can submit crafted input and execute arbitrary commands on the underlying OS; exploitation additionally requires more than one network interface and an active IPsec tunnel. Cisco assigned a High Security Impact Rating because root escalation from the achieved privilege level is considered easy. A public exploit is available. The CVE is not in CISA KEV. EPSS is 0.4% (37th percentile) and flat; this is a predicted likelihood, not confirmation of in-the-wild exploitation.