WaratekVRT Sign in

CVE-2026-20180 Cisco Identity Services Engine

Affected softwareCisco Identity Services Engine
Severity9.9 Critical CVSS 3.1
WeaknessPath traversal (CWE-22)
Published15 Apr 2026
Updated26 Oct 2026

Description

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 6.1% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC kaleth4/CVE-2026-20180 1 2026-04-21

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/identity_services_engine). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

Affected software and releases

Products and versions

1 product, 21 version entries
SourceVendorProductSchemeAffected versions
nvd cisco identity services engine generic 3.2.0 · ＜ 3.2.0 · 3.2.0:patch1 · 3.2.0:patch2 · 3.2.0:patch3 · 3.2.0:patch4 · 3.2.0:patch5 · 3.2.0:patch6 · 3.2.0:patch7 · 3.3.0 · 3.3.0:patch1 · 3.3.0:patch2 · 3.3.0:patch3 · 3.3.0:patch4 · 3.3.0:patch5 · 3.3.0:patch6 · 3.3.0:patch7 · 3.4.0 · 3.4.0:patch1 · 3.4.0:patch2 · 3.4.0:patch3

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv Vendor Advisory

Timeline
Published2026-04-15By the CVE Program.
NVD record modified2026-10-26NVD's own last-modified date for this record.