CVE-2026-20176

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified)

Description Insufficient validation of user-supplied input allows an authenticated remote attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying operating system. The attack is performed by sending a crafted HTTP request to the createDBLink function. Successful exploitation can grant system-level access and allow the attacker to elevate privileges to root. In single-node deployments, this may lead to a Denial of Service (DoS) condition, preventing unauthenticated endpoints from accessing the network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.