Zero Day Initiative Discloses Cisco ISE RCE Vulnerability
A deserialization flaw in Cisco Identity Services Engine allows authenticated remote attackers to achieve arbitrary code execution.
The Zero Day Initiative (ZDI) has published details on a critical remote code execution (RCE) vulnerability affecting Cisco Identity Services Engine (ISE). Designated ZDI-26-717 and assigned CVE-2026-20211, the flaw resides within the AlarmMessageDiskQueue component and requires prior authentication to exploit.
The vulnerability stems from the component's failure to properly validate user-supplied data, leading to the deserialization of untrusted data. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the iseadminportal user, potentially granting them significant control over the affected ISE instance.
Cisco has acknowledged the vulnerability and released security updates to address it. The company's advisory, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57, provides detailed information on affected versions and the necessary patches.
This vulnerability was initially reported to Cisco by Jonathan Lein of TrendAI Research on May 28, 2026. The ZDI coordinated the public release of the advisory on September 18, 2026, following Cisco's issuance of a fix. The advisory was updated on the same day, indicating ongoing information dissemination.
With a CVSS score of 7.2, this vulnerability presents a significant risk to organizations relying on Cisco ISE for network access control and identity management. The requirement for authentication means that attackers must first compromise legitimate user credentials or exploit another vulnerability to gain access before leveraging this RCE flaw.
Cisco ISE plays a crucial role in enterprise security infrastructures, managing user identities and enforcing access policies. Exploitation of this vulnerability could lead to unauthorized access, data breaches, or further compromise of the network. Organizations using affected versions of Cisco ISE are strongly advised to apply the available patches immediately.
The disclosure highlights the persistent threat of deserialization vulnerabilities, which continue to be a common attack vector across various software products. Secure coding practices, including rigorous input validation and avoiding deserialization of untrusted data, remain paramount in preventing such flaws.
This new advisory from Zero Day Initiative details a specific XML External Entity (XXE) processing vulnerability within the MnTRESTLivelogService class of Cisco Identity Services Engine. While the existing story covers a broader RCE vulnerability, this new finding (ZDI-26-718) requires authentication and allows remote attackers to disclose sensitive information by exploiting the parser's improper restriction of XXE references, potentially embedding contents from specified URIs into the XML document.