This vulnerability, tracked as CVE-2026-20130, affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It stems from improper neutralization of special elements in output, which can be exploited to perform injection attacks. The issue falls under CWE-74 and was identified during an internal security review by Cisco. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary commands or inject malicious content, potentially compromising the entire system's confidentiality, integrity, and availability. Given the critical CVSS score of 10.0, the impact is severe and could lead to full system compromise.

Cisco has released a software hardening update that addresses this vulnerability as part of their ongoing security efforts. Users should apply the official patches or updates provided by Cisco for affected versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by Cisco's internal review and release of hardened software.