Critical Cisco ISE Flaws Let Remote Attackers Execute Malicious Code

Networking giant Cisco has issued an urgent security advisory warning of two newly discovered vulnerabilities impacting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).

Cisco Identity Services Engine (ISE) is a widely deployed security policy management platform that provides secure access to enterprise network resources.

The most severe of these new flaws could allow an authenticated, remote attacker to achieve full remote code execution (RCE) and compromise affected infrastructure.

According to the official Cisco advisory published on April 15, 2026, the vulnerabilities reside in the web-based management interfaces of both products.

While exploitation requires valid administrative credentials, the potential impact remains catastrophic, prompting a critical severity rating.

Technical Details and Vulnerability Breakdown

The security bulletin outlines two distinct security flaws that operate independently of one another. Threat actors do not need to chain these vulnerabilities together to launch a successful attack.

• CVE-2026-20147 (CVSS Score 9.9 – Critical): This remote code execution vulnerability stems from insufficient validation of user-supplied input. Threat actors can exploit this by sending maliciously crafted HTTP requests to an affected device. A successful attack grants user-level access to the underlying operating system, which can then be trivially elevated to root privileges. Furthermore, in single-node ISE deployments, this exploit can trigger a complete denial of service (DoS), locking unauthenticated endpoints out of the network until the node is fully restored.
• CVE-2026-20148 (CVSS Score 4.9 – Medium): This path traversal flaw is caused by improper input validation. By sending specific HTTP requests, authenticated attackers can bypass directory restrictions to read arbitrary, sensitive files stored on the underlying operating system.

Mitigation Strategies and Patch Availability

Cisco has confirmed that there are currently no available workarounds or temporary mitigations to prevent exploitation.

Organizations must apply the official software updates immediately to secure their network environments.

Administrators are strongly advised to upgrade their systems according to the following official patch guidance:

• Deployments running version 3.1 must upgrade to 3.1 Patch 11.
• Environments using version 3.2 should apply 3.2 Patch 10.
• Systems operating on version 3.3 are advised to install 3.3 Patch 11.
• Administrators on version 3.4 need to update to 3.4 Patch 6.
• Networks utilizing version 3.5 must be updated to 3.5 Patch 3.
• Legacy versions prior to 3.1 require an immediate migration to a supported, fixed release.

These critical vulnerabilities were independently discovered and reported to Cisco by security researcher Jonathan Lein of TrendAI Research.

At the time of publication, the Cisco Product Security Incident Response Team (PSIRT) stated they are not aware of any public proof-of-concept (PoC) exploits or active malicious exploitation in the wild.

However, given the massive 9.9 CVSS score of CVE-2026-20147, cybersecurity teams are strongly urged to prioritize these patches in their vulnerability management cycles before threat actors can reverse-engineer the software fixes.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.