According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities.

  - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct     SQL injection attacks. (CVE-2026-20284)

  - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct     SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST     API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A     successful exploit could allow the attacker to view or modify data on the underlying database for the     affected device. In single-node deployments, successful exploitation of this vulnerability could cause the     affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that     have not already authenticated would be unable to access the network until the node is restored. To     exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service     enabled, and have at least one SXP connection configured. (CVE-2026-20284)

  - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the     underlying operating system of an affected device. (CVE-2026-20282)

  - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the     underlying operating system of an affected device. This vulnerability is due to insufficient validation of     user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an     affected device. A successful exploit could allow the attacker to obtain write access to the underlying     operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
    Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as     the score indicates. The reason is that it is easy to get to root from the achieved privilege level.
    (CVE-2026-20282)

  - A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker     to inject arbitrary commands on the underlying operating system. This vulnerability is due to     insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit this     vulnerability by sending crafted input to the IPsec Open API endpoint on an affected device. A successful     exploit could allow the attacker to execute arbitrary commands on the underlying operating system.
    To exploit this vulnerability, the attacker must have valid administrative credentials and the node must     have more than one network interface, one of which must be configured as an active IPsec tunnel. Note: For     CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score     indicates. The reason is that it is easy to get to root from the achieved privilege level.
    (CVE-2026-20283)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

critical Nessus Plugin ID 348172

Version 1.4

Version 1.3

Version 1.1

Version 1.4 Sep 23, 2026, 8:20 AM CVSS metrics ("CVSSv2 score" set to 8.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2026-20282" to "CVE-2026-20284") CVSSv2 severity (based on CVE-2026-20284, severity increased from "Medium" to "High") CVSSv3 score source (changed from "CVE-2026-20284" to none) Plugin Feed: 202609230820
Version 1.3 Sep 21, 2026, 3:50 PM CVSSv2 score source (changed from "CVE-2026-20284" to "CVE-2026-20282") CVSSv3 score source (set to "CVE-2026-20284") Metadata (Add IAVM info) Plugin Feed: 202609211550
Version 1.1 Sep 18, 2026, 11:05 PM New Plugin Feed: 202609182305