Introduction
A critical command injection vulnerability in Cisco Identity Services Engine allows an authenticated attacker with nothing more than Read Only Admin credentials to escalate all the way to root on the underlying operating system. Many organizations rely on ISE as their primary network access control platform. For them, a compromised node puts the gatekeeper to network access under attacker control. In single-node deployments, it can also deny service to every unauthenticated endpoint.
Technical Information
The root cause of CVE-2026-20186 is insufficient validation of user-supplied input in the Cisco ISE web management interface. The vulnerability is classified under both CWE-77 (Command Injection) and CWE-22 (Path Traversal). Together, these classifications indicate that the flaw involves injecting operating system commands through improperly sanitized input fields that are accessible via HTTP requests.
The CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which yields a Base Score of 9.9. The attack is network based and low complexity. It needs only low privileges (Read Only Admin), requires no user interaction, and changes scope. All three impact dimensions (confidentiality, integrity, availability) are rated high.
The changed scope designation (S:C) signals that the attacker can affect resources beyond the ISE application itself. That matches the demonstrated ability to break out of the application context into the underlying operating system and then escalate to root.
Attack Flow
Exploitation proceeds in five stages:
- The attacker authenticates to the Cisco ISE web management interface with at least Read Only Admin credentials, the minimum privilege level that exploitation requires.
- The attacker sends a specially crafted HTTP request that targets the vulnerable input validation logic in the management interface.
- The crafted input gets through the insufficient validation and results in arbitrary command execution on the underlying operating system.
- That command execution gives the attacker user-level access to the underlying OS.
- From user-level access, the attacker escalates privileges to root and gains full control over the ISE node.
In single-node ISE deployments, successful exploitation can make the affected ISE node unavailable. The result is a denial of service in which endpoints that have not already completed authentication cannot access the network until the node is restored.
Because ISE is a network access control platform, an attacker could use a compromised ISE node to manipulate network access policies, intercept authentication traffic, or pivot to other network infrastructure. Cisco has confirmed that these vulnerabilities affect Cisco Identity Services Engine regardless of device configuration. The Cisco ISE Passive Identity Connector is not affected.
Affected Systems and Versions
The following Cisco ISE releases are affected:
| Cisco ISE Release | First Fixed Release |
|---|---|
| Earlier than 3.2 | Migrate to a fixed release |
| 3.2 | 3.2 Patch 8 |
| 3.3 | 3.3 Patch 8 |
| 3.4 | 3.4 Patch 4 |
| 3.5 | Not vulnerable |
All configurations of Cisco ISE are affected. The Cisco ISE Passive Identity Connector is explicitly not affected.
Cisco has stated that no workarounds are available, so upgrading to a fixed software release is the only effective mitigation. Until the patches are deployed, organizations should enforce strict credential management for Read Only Admin accounts to reduce the attack surface, because the vulnerability requires at least that privilege level.
Vendor Security History
Cisco has a dedicated Product Security Incident Response Team (PSIRT) that manages the reporting and disclosure of security vulnerability information. The Cisco Advanced Security Initiatives Group (ASIG) discovered CVE-2026-20186 internally during security testing. Internal testing of this kind is a proactive way to find vulnerabilities before anyone outside discovers or exploits them. Cisco ISE has been the subject of multiple security advisories over the years, and Cisco keeps a well-established cadence of patch releases and security advisory publications.
When the advisory was published, the Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability in the wild. Even so, organizations should assume that threat actors will try to reverse engineer the patches to develop exploit code. The vulnerability has a critical CVSS score of 9.9, allows root privilege escalation on ISE, a platform with strategic value as the network's NAC system, and has a relatively low barrier to exploitation. Together, those make it an attractive target.
