Cisco ISE: 22 Vulnerabilities Disclosed, Including Critical RCE and Auth Bypass Flaws
Cisco ISE and ISE-PIC face a severe security event with 22 vulnerabilities disclosed, including critical flaws enabling RCE and admin access, with one actively exploited.
Key findings
- 22 vulnerabilities disclosed in Cisco ISE and ISE-PIC on September 16, 2026.
- Critical flaws allow RCE, admin access, and file operations.
- CVE-2026-76423 (CVSS 10.0) enables unauthenticated admin access and was actively exploited.
- Multiple SQL injection vulnerabilities affect authenticated and unauthenticated users.
- Patches are available; immediate application is recommended.
On September 16, 2026, Cisco Systems disclosed a significant batch of 22 vulnerabilities affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. This coordinated disclosure event, spanning just four hours, highlights a wide range of security weaknesses, including critical-severity flaws that could allow attackers to gain administrative access and execute arbitrary code. The vulnerabilities were reported by various sources, with Cisco subsequently releasing patches to address them.
Several vulnerabilities center on improper input validation, leading to critical security issues. CVE-2026-20284, a critical flaw, allows authenticated attackers to upload or copy arbitrary files due to insufficient validation in file operations. Similarly, CVE-2026-20211, CVE-2026-20176, CVE-2026-20307, CVE-2026-20306, and CVE-2026-20305 are critical vulnerabilities that enable authenticated attackers with administrative credentials to execute arbitrary commands on the underlying operating system through various mechanisms like insecure deserialization, command injection, or diagnostic tool manipulation.
A particularly alarming vulnerability, CVE-2026-76423, rated critical with a CVSS score of 10.0, allows unauthenticated, remote attackers to gain administrative access to affected devices. This is due to insufficient authorization checks on the REST API web service. The Hacker News reported that this vulnerability was actively exploited in the wild shortly after its disclosure.
SQL injection remains a prevalent threat, with multiple CVEs detailing this risk. CVE-2026-76428, CVE-2026-76425, and CVE-2026-20300 are medium to high severity SQL injection vulnerabilities, requiring authenticated access and exploiting improper parameter handling in REST APIs or direct concatenation into SQL clauses. CVE-2026-20247, also an SQL injection vulnerability, is notable for allowing unauthenticated attackers to exploit improper input validation.
Other vulnerabilities include the ability for authenticated attackers to read specific files on the operating system (CVE-2026-76446, CVE-2026-76434, CVE-2026-76427), delete arbitrary files (CVE-2026-76431), retrieve sensitive configuration information (CVE-2026-76444), submit forged posture status events (CVE-2026-76439), obtain sensitive information about network users (CVE-2026-20072), and hijack BYOD onboarding sessions (CVE-2026-20071). Additionally, CVE-2026-20283, a medium-severity flaw, allows authenticated attackers to inject arbitrary commands into the operating system via the IPsec Open API.
Cisco has released updates to address all 22 vulnerabilities. Users are strongly advised to apply these patches immediately to mitigate the risk of exploitation. The wide range and severity of these flaws underscore the importance of maintaining up-to-date security configurations and applying vendor patches promptly to protect sensitive network infrastructure managed by Cisco ISE. The active exploitation of CVE-2026-76423 highlights the immediate threat posed by unpatched systems.