CVE-2026-20306

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified) Cisco ISE-PIC (affected versions not specified)

Description An issue in the REST API of the affected software allows an authenticated remote attacker with administrative credentials to perform command injection attacks on the underlying operating system. This is caused by improper validation of user-supplied input sent to the web-based management interface. A successful exploit enables the attacker to execute arbitrary code and elevate privileges to root. In single-node deployments, this could lead to a Denial of Service (DoS) condition, preventing unauthenticated endpoints from accessing the network until the node is restored.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.