Critical Command Execution Vulnerability Patched in Cisco ISE

Key Points:

• A critical command execution vulnerability (CVE-2026-20181) has been identified in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), allowing authenticated attackers to execute arbitrary commands on the underlying operating system.
• The vulnerability has a CVSS score of 9.1 and can lead to privilege escalation, denial-of-service conditions, and unauthorized access to sensitive data. Affected systems include Cisco ISE versions prior to the patched releases.
• It is recommended that organizations immediately update to ISE version 3.3 Patch 11, 3.4 Patch 6, or apply the hotfix for version 3.5 to mitigate this risk.

Technical Details: The vulnerability arises from improper validation of user-supplied input, enabling attackers with valid administrative credentials to send crafted HTTP requests that exploit the flaw.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Defense Evasion, Privilege Escalation)

IOCs Mentioned: None mentioned