Introduction
A critical authenticated remote code execution flaw in Cisco Identity Services Engine lets an attacker holding nothing more than Read Only Admin credentials escalate all the way to root on the underlying operating system. Many organizations rely on ISE as their central network access control and zero-trust policy engine. For them, this vulnerability (scored CVSS 9.9) directly threatens the component that decides who and what gets onto the network.
Technical Information
CVE-2026-20180 stems from insufficient validation of user-supplied input on the Cisco ISE web management interface. The vulnerability maps to two CWE classifications: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal) and CWE-77 (Command Injection). Together, these weaknesses allow a crafted HTTP request to both traverse restricted file system paths and inject arbitrary operating system commands.
Prerequisites
The attack requires two conditions:
- Network access to the Cisco ISE management interface (typically HTTPS on the admin portal).
- Valid credentials with at least Read Only Admin privileges.
The Read Only Admin role is the lowest tier of administrative access in ISE. It is commonly provisioned for auditors, helpdesk staff, and monitoring integrations, so the pool of accounts an attacker could use is often larger than organizations realize.
Attack Flow
Based on the advisory details, exploitation proceeds in this order:
- The attacker authenticates to the ISE management web interface with Read Only Admin (or higher) credentials.
- The attacker sends a specially crafted HTTP request to the ISE management endpoint. The request exploits the insufficient input validation to bypass standard application controls.
- The request lets the attacker interact directly with the underlying operating system and obtain a user-level shell.
- From that foothold, the attacker escalates privileges to root and takes complete control of the ISE appliance.
- In single-node ISE deployments, successful exploitation can also make the affected ISE node unavailable. Until the node is restored, endpoints that have not already authenticated cannot access the network.
Cisco ISE is closed source, so there are no public code commits or diffs to inspect. X.B. of the Cisco Advanced Security Initiatives Group (ASIG) found the vulnerability during internal security testing. No public proof-of-concept exploit code or detailed indicators of compromise have been released.
Security teams should monitor web access logs for anomalous HTTP requests directed at ISE management endpoints, particularly from accounts with Read Only Admin privileges.
Patch Information
On April 15, 2026, Cisco released software updates for CVE-2026-20180 under advisory ID cisco-sa-ise-rce-4fverepv. No workarounds are available. Patching is the only remediation path.
The patch strengthens input sanitization on the affected ISE web interface endpoints, so an authenticated attacker can no longer break out to the underlying operating system and escalate to root. The fix is tied to two Cisco Bug IDs: CSCwq21242 and CSCwq22993.
Cisco provides this fixed release matrix:
| Cisco ISE Release | First Fixed Release |
|---|---|
| Earlier than 3.2 | Migrate to a fixed release. |
| 3.2 | 3.2 Patch 8 |
| 3.3 | 3.3 Patch 8 |
| 3.4 | 3.4 Patch 4 |
| 3.5 | Not vulnerable. |
ISE release 3.5 is not affected, which suggests the input validation improvements were already in its codebase before general availability. Cisco does not provide a direct patch for ISE versions older than 3.2. Customers running those versions must migrate to a supported, fixed release.
Organizations should patch single-node deployments first, because the denial-of-service risk there could halt network authentication for new endpoints. They should also audit every account with Read Only Admin privileges or higher right away, and disable any that are unnecessary or potentially compromised.
Affected Systems and Versions
The following Cisco ISE releases are affected:
- Cisco ISE versions earlier than 3.2: Vulnerable. No direct patch available. Migration to a fixed release is required.
- Cisco ISE 3.2: Vulnerable. Fixed in 3.2 Patch 8.
- Cisco ISE 3.3: Vulnerable. Fixed in 3.3 Patch 8.
- Cisco ISE 3.4: Vulnerable. Fixed in 3.4 Patch 4.
- Cisco ISE 3.5: Not vulnerable.
Cisco ISE Passive Identity Connector (ISE PIC) is confirmed not vulnerable and requires no action.
Single-node ISE deployments carry extra risk, because a denial-of-service condition could block new endpoints from authenticating.
Vendor Security History
The ISE platform has a record of recurring critical vulnerabilities. In 2025, Cisco fixed a series of critical unauthenticated remote code execution vulnerabilities in ISE, specifically CVE-2025-20281 and CVE-2025-20337, which carried a CVSS score of 10.0. Attackers exploited them in the wild, and they were later added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
The 2025 and 2026 ISE vulnerabilities compare as follows:
| Year | CVE Identifiers | Authentication Required | CVSS Score | Active Exploitation Observed |
|---|---|---|---|---|
| 2026 | CVE-2026-20180 | Yes (Read Only Admin) | 9.9 | No (as of disclosure) |
| 2025 | CVE-2025-20281, CVE-2025-20337 | No | 10.0 | Yes |
Critical remote code execution flaws keep appearing in this central policy engine, so organizations should keep their network access control infrastructure on an aggressive patching schedule.
