CVE-2026-20284

Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.1Critical EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Cisco Identity Services Engine Software and whether SXP is enabled with an SXP connection configured.
Identify all administrator accounts that can access the SXP REST API; remove unnecessary access and reset credentials you do not recognize.
Cisco has not published a fixed version yet; ask Cisco or your support provider for the vendor-approved update as soon as it is available.
Until then, disable SXP if your network does not need it, or restrict SXP REST API access to only the required administrators and management network.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.

In plain language

Written by AI from the record

A critical flaw in Cisco Identity Services Engine Software can let a logged-in administrator alter its database through a public exploit, so affected businesses should act now even though Cisco has not published a fix.

Authenticated SQL injection in the Cisco Identity Services Engine Software SXP REST API (CWE-943) allows crafted API input to read or modify the underlying database and can cause a single-node deployment to become unavailable.

If you're affected

Network access disruption
Identity data changes
Database data exposure
Single-node service outage

What is it

This is a flaw in a management interface that can allow an authorized administrator account to send specially formed requests that change or view information stored by the system. It is like someone with a staff key finding a way to alter the records room itself, rather than only using the records they are permitted to see. On a single-server setup, it can also stop new devices from being allowed onto the network until service is restored.

Who is affected

This matters to you if you run Cisco Identity Services Engine Software to control access to your business network. It is only a risk when SXP is enabled, at least one SXP connection is configured, and an attacker has valid administrative credentials.

How urgent is it

A public exploit is available, making this a red-priority issue for organizations that meet the attack conditions. Act now to limit administrative access and remove or isolate the affected feature while you wait for Cisco’s fix guidance.

What to do — in detail

Confirm exposure by reviewing Cisco Identity Services Engine Software configuration for the SXP service, configured SXP connections, and administrator access to the SXP REST API. No affected-version range or fixed release has been provided, so there is no safe target version to name yet; obtain Cisco’s advisory or support guidance before scheduling an upgrade.

If SXP is not required, disable it as the temporary workaround. If it is required, limit REST API access to trusted management hosts, reduce the number of administrative accounts, review recent administrative activity and API requests for unexpected database-related actions, and ensure a tested recovery path exists for a single-node deployment.

CISA KEV does not list this CVE, so there is no CISA remediation due date. Monitor Cisco advisories for a fixed release and investigate unexpected SXP configuration changes, administrator-account activity, database changes, or loss of service to newly authenticating endpoints.

Technical context

CVE-2026-20284 is rated CVSS 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). It is CWE-943 SQL injection in the SXP REST API, caused by insufficient validation of user-supplied REST API input. Exploitation requires valid administrative credentials, SXP enabled, and at least one SXP connection configured; successful exploitation can read or modify the underlying database and may cause denial of service on single-node deployments. A public exploit is available. CISA KEV does not list the CVE. EPSS is 0.4% (33rd percentile) with a flat trend; this is a prediction, not evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2 days, from the signal feeds we watch.

2026-09-18Record updatedrecord updated
2026-09-17Record updatedrecord updated, record updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Identity Services Engine SoftwareNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-943No name in the record

Sources

References in the record

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Cisco, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account