Cisco ISE and ISE-PIC contain a critical vulnerability (CVE-2026-20181) due to improper validation of user-supplied input, enabling an authenticated remote attacker with valid administrative credentials to execute arbitrary OS commands and escalate privileges to root. This vulnerability affects multiple versions of Cisco ISE and ISE-PIC. Exploitation in single-node deployments may also cause denial-of-service conditions. Cisco has released official patches in ISE versions 3.3 Patch 11, 3.4 Patch 6, and a hotfix for 3.5, with a full patch forthcoming in 3.5 Patch 4. The updates also fix a high-severity information disclosure vulnerability (CVE-2026-20190). Cisco is not aware of active exploitation in the wild. The vulnerability requires valid admin credentials, limiting exposure to authenticated attackers.

An attacker with valid administrative credentials can execute arbitrary commands on the underlying operating system of affected Cisco ISE devices, potentially gaining root privileges. This can lead to full system compromise. In single-node deployments, exploitation can cause denial-of-service, preventing unauthenticated endpoints from accessing the network until service restoration. The related information disclosure vulnerability could allow unauthenticated attackers to access sensitive data such as hashed credentials. No active exploitation has been reported.

Cisco has released official patches addressing this vulnerability in ISE versions 3.3 Patch 11, 3.4 Patch 6, and a hotfix for 3.5, with a full patch planned in 3.5 Patch 4. Applying these updates is the recommended remediation. Since the vulnerability requires valid administrative credentials, organizations should also ensure strong credential management and limit administrative access. No additional mitigation steps are indicated by Cisco. Patch status is confirmed as official fixes available.