CVE-2026-20284

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified)

Description An issue in the SXP REST API allows an authenticated remote attacker to perform SQL injection attacks due to insufficient validation of user-supplied input in REST API calls. A successful exploit enables the attacker to view or modify data within the underlying database. In single-node deployments, this could lead to a Denial of Service (DoS) condition, rendering the node unavailable and preventing unauthenticated endpoints from accessing the network. Exploitation requires valid administrative credentials, the SXP service to be enabled, and at least one configured SXP connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.