A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-20309 is a reflected cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). It allows an unauthenticated remote attacker to inject malicious scripts by persuading a user to click a crafted link. The vulnerability arises from improper validation of user-supplied input in the interface. Successful exploitation could lead to execution of arbitrary script code in the context of the interface and potential access to sensitive browser-based information. The vulnerability affects specific versions of Cisco ISE software.
A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database.
This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76433 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper limitation of a pathname to a restricted directory, allowing an unauthenticated remote attacker to perform a path traversal attack via the client provisioning download feature. Exploitation could lead to unauthorized access to protected files, potentially exposing sensitive information. No authentication is required to exploit this vulnerability.
A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload.
This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition.
Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.
A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline.
This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.
CVE-2026-20342 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) that allows an authenticated attacker with Security Analyst role privileges to download arbitrary files from the system due to improper input sanitization in a file download API.
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain write access to the underlying operating system.
To exploit this vulnerability, the attacker must have valid administrative credentials.
Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.
CVE-2026-20323 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Secure FTD Software. It involves improper TLS certificate validation in the sftunnel inter-device communication protocol. An unauthenticated adjacent attacker could impersonate a peer device and gain manager-level (root-equivalent) access by exploiting this flaw. Successful exploitation requires the sftunnel connection to be down or disrupted to allow the attacker to connect with a crafted TLS certificate.
CVE-2026-76412 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) that allows an authenticated remote attacker to elevate privileges to root by exploiting an error in privilege level checks within the remote diagnostics debugger service. Exploitation requires valid user credentials and involves a complex, multistage process.
CVE-2026-20283 is an OS command injection vulnerability in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) software. It allows an authenticated attacker with administrative credentials to execute arbitrary OS commands. Exploitation requires the node to have multiple network interfaces with an active IPsec tunnel. Cisco rates the security impact as High due to the ease of privilege escalation to root. The CVSS v3.1 base score is 6.5 (medium severity).
CVE-2026-20333 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software caused by incorrect comparison conditions. It was identified during an internal security review by Cisco, leading to a software hardening release addressing multiple vulnerabilities. The flaw relates to CWE-697, which involves improper comparison logic. The vulnerability affects specific versions of Cisco ASA software and has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability.
CVE-2026-76425 is a high-severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) Software APIs. It allows an authenticated attacker with administrative privileges to inject malicious SQL commands due to insufficient validation of input parameters. Exploitation can lead to unauthorized reading of backend database content and server-side request forgery (SSRF) attacks. The affected versions are 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0.
CVE-2026-20334 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software caused by improper adherence to coding standards related to CWE-710. Cisco conducted an internal security review that identified multiple vulnerabilities, leading to a software hardening release addressing these issues. The vulnerability affects specific versions of the ASA software and has a CVSS score of 8.4, indicating a significant risk. No known exploits are reported in the wild. The vulnerability impacts confidentiality, integrity, and availability with high privileges required and user interaction necessary.
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
CVE-2026-76424 is a high-severity vulnerability in the REST API of Cisco Identity Services Engine (ISE) Software. It allows an authenticated attacker with administrative privileges to upload or copy arbitrary files to the device by exploiting insufficient validation of file paths. Successful exploitation can lead to arbitrary command execution as root on the affected device. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE. No information about available patches or vendor advisories is provided.
CVE-2026-20332 is a critical improper access control vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software. It was identified during an internal security review by Cisco, leading to a software hardening release addressing multiple vulnerabilities. The flaw relates to CWE-284, indicating weaknesses in access control mechanisms. The vulnerability has a high CVSS score of 9.9, reflecting its potential to cause severe confidentiality, integrity, and availability impacts. Multiple specific ASA software versions are affected. No known exploits are reported in the wild at this time.
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation.