Introduction
A critical command injection flaw in Cisco Identity Services Engine lets an authenticated administrator break out of the application layer, land on the underlying operating system, and escalate all the way to root. Many enterprises rely on Cisco ISE as their sole network access control gateway. For them, this vulnerability (scored CVSS 9.9) opens a direct path from compromised admin credentials to full infrastructure compromise and, in single-node deployments, a network-wide denial of service.
Technical Information
CVE-2026-20147 is tracked under Cisco Bug ID CSCws52738 and classified as CWE-77 (Command Injection). The root cause is insufficient validation of user-supplied input in the web management interface of Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC). When an authenticated administrator submits a crafted HTTP request, ISE does not properly sanitize the input before passing it to the underlying operating system, so the OS interprets and executes the injected commands.
The full CVSS 3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
This vector reflects a network-accessible attack surface, low attack complexity, low privilege requirements (valid admin credentials), no user interaction, and a changed scope with high impact across confidentiality, integrity, and availability. The changed scope means the attacker breaks out of the vulnerable component (the ISE web application) and affects the underlying operating system, which is a separate security authority.
Attack Flow
The exploitation chain has four stages:
-
The attacker first obtains valid administrative credentials for the Cisco ISE or ISE-PIC web interface. These could come from phishing, credential reuse, or a compromised credential store.
-
The attacker sends a specially crafted HTTP request to the ISE management interface. The request targets the vulnerable input validation path and embeds OS commands in the user-supplied input.
-
If the injection succeeds, the attacker gets user-level access to the underlying operating system of the ISE appliance.
-
From this foothold, the attacker escalates privileges to root and gains full control over the device and its configuration, certificates, and network policy data.
Denial-of-Service Impact in Single-Node Deployments
In single-node ISE deployments, successful exploitation can make the affected ISE node completely unavailable. ISE is the authentication and authorization gateway, so an outage creates a denial-of-service condition: endpoints that have not already authenticated cannot access the network until the node is restored. Organizations running ISE as a single node therefore face a potential network outage on top of the infrastructure compromise.
Companion Vulnerability: CVE-2026-20148
Cisco disclosed CVE-2026-20148 (Bug ID CSCws52717) alongside CVE-2026-20147. It is a path traversal vulnerability with a CVSS base score of 4.9. It also requires valid administrative credentials and is caused by improper validation of user-supplied input. An attacker who sends a crafted HTTP request can use path traversal to access and read arbitrary sensitive files on the underlying operating system. The two vulnerabilities are independent, and exploiting one does not require exploiting the other. Both are fixed in the same patch cycle.
Patch Information
Cisco has released software updates that fix CVE-2026-20147 as part of advisory cisco-sa-ise-rce-traversal-8bYndVrZ, published on April 15, 2026. The patch tightens input validation so crafted HTTP requests can no longer reach the underlying operating system and be interpreted as executable commands.
Cisco has stated that no workarounds exist. Upgrading to a patched release is the only remediation path.
The fixed releases span several major ISE and ISE-PIC branches. Administrators should identify their current release and upgrade accordingly:
| Cisco ISE / ISE-PIC Release | First Fixed Release |
|---|---|
| Earlier than 3.1 | Migrate to a fixed release |
| 3.1 | 3.1 Patch 11 (Apr 2026) |
| 3.2 | 3.2 Patch 10 (Apr 2026) |
| 3.3 | 3.3 Patch 11 (Apr 2026) |
| 3.4 | 3.4 Patch 6 (Apr 2026) |
| 3.5 | 3.5 Patch 3 |
A few notes on the table:
- Cisco does not provide a direct patch for releases earlier than 3.1. Those environments must migrate to a supported release that includes the fix.
- Cisco ISE-PIC has reached end-of-sale status, and release 3.4 is the last supported version. ISE-PIC users should apply 3.4 Patch 6 as their terminal fix.
- Each patch listed above fixes both CVE-2026-20147 and the companion path traversal vulnerability CVE-2026-20148, so applying any of them remediates both CVEs at once.
Cisco released the advisory with a status of "Final," which means no further revisions to the fixed-release information are expected. The fix is available through normal Cisco software download channels. For step-by-step upgrade instructions specific to a deployment, administrators should consult the Upgrade Guides on the Cisco ISE support page.
Affected Systems and Versions
The vulnerability affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of device configuration. The following releases are confirmed vulnerable:
- All Cisco ISE and ISE-PIC releases earlier than 3.1
- Cisco ISE / ISE-PIC 3.1 (versions prior to 3.1 Patch 11)
- Cisco ISE / ISE-PIC 3.2 (versions prior to 3.2 Patch 10)
- Cisco ISE / ISE-PIC 3.3 (versions prior to 3.3 Patch 11)
- Cisco ISE / ISE-PIC 3.4 (versions prior to 3.4 Patch 6)
- Cisco ISE 3.5 (versions prior to 3.5 Patch 3)
Single-node ISE deployments carry elevated risk, because successful exploitation can cause a complete denial of network access.
Cisco ISE-PIC has reached its end-of-sale date, and release 3.4 is the last supported version.
Vendor Security History
Cisco PSIRT aligns its disclosure practices with ISO/IEC 29147:2018, which sets international guidelines for vulnerability disclosure. Cisco published this advisory as a Final version 1.0 with clear CVSS metrics, bug IDs, and specific patch branches, which points to a mature vulnerability management process. When the advisory was published, Cisco PSIRT said it was not aware of any public announcements or malicious use of CVE-2026-20147.
