CVE-2026-20211

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified)

Description An issue exists that allows an authenticated remote attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying operating system. This is caused by insecure deserialization of Java objects, where the software fails to properly validate serialized data. An attacker can exploit this by sending a crafted serialized Java object to the device, potentially gaining user-level access and elevating privileges to root. In single-node deployments, this could lead to a Denial of Service (DoS) condition, preventing unauthenticated endpoints from accessing the network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.