CVE-2026-20305

Cisco Identity Services Engine Command Injection Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.1Critical EPSS percentile71st1.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization runs Cisco Identity Services Engine software, including the Passive Identity Connector, and identify who has administrator access.
Ask Cisco or your support provider for the vendor-recommended fixed version; no patch or fixed version information is currently available.
Until a fix is available, restrict the web management interface to a small set of trusted administrator networks and review administrator accounts for unnecessary access.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

In plain language

Written by AI from the record

A serious flaw in Cisco Identity Services Engine software lets someone with an administrator login take over the system; typical businesses using it should act now, but no fixed version is available yet.

Authenticated remote command injection (CWE-78) in Cisco ISE diagnostic tools permits an administrator-level attacker to execute arbitrary operating-system commands and elevate to root.

If you're affected

Full system takeover
Network access disruption
Unauthenticated devices blocked
Sensitive identity data exposure
Operational downtime

What is it

This is a weakness in administrative diagnostic features that can let a person already signed in as an administrator make the system run commands it should reject. It is like giving a building manager’s keycard the ability to unlock every room and shut off the front desk, potentially stopping new employees or visitors from getting in.

Who is affected

This matters to you if you run Cisco Identity Services Engine software, including its Passive Identity Connector, to control or track access to your network. The attacker must already have valid administrator credentials and be able to reach its web-based management interface.

How urgent is it

A public exploit is available, and an attacker with an administrator login can use it to take full control of the affected system. Treat this as urgent: limit administrative access now and obtain Cisco’s remediation guidance as soon as possible.

What to do — in detail

Confirm whether Cisco Identity Services Engine software or its Passive Identity Connector is deployed, then inventory the installed release, deployment type, administrator accounts, and networks allowed to reach the web management interface. No vendor fixed version or patch information is available in the findings, so do not assume an upgrade target; obtain the current Cisco advisory or support guidance before changing versions.

If patching is delayed, allow management-interface access only from dedicated administrator networks, remove dormant or unneeded administrator accounts, rotate credentials where compromise is suspected, and require the strongest available administrator authentication controls. Review management-interface and system logs for unexpected diagnostic-tool use, command execution, new privileged accounts, configuration changes, or node outages. This CVE is not listed in CISA KEV, so no CISA KEV due date is provided.

Technical context

Severity is CVSS 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The issue is CWE-78 command injection: crafted input sent to the web-based management interface’s diagnostic tools can lead to arbitrary OS command execution and root privilege escalation. Exploitation requires valid administrative credentials; a public exploit is available. EPSS predicts 1.4% likelihood (71st percentile) and is flat. The CVE is not listed in CISA KEV, meaning CISA has not designated it as a known exploited vulnerability in that catalog; the findings do not confirm exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS71st

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

1.4% chance of exploitation activity in the next 30 days, which ranks it in the 71st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1 day, from the signal feeds we watch.

2026-09-17Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Identity Services Engine SoftwareNetworking Infrastructure
- Cisco ISE Passive Identity ConnectorNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable