Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

#TRUSTED 15782ba01206c86094d2fec1b2d7bf03aee8dacde260a33bbb5a0d5acaf042173eacb38562b398bf4583a94a6258f58747436c1c8feab48ca4a4c5f74b9586b2130d96fc02629c39e11a78b1a1e8f50f5bd0a7eceaac7212fb60f2c23edc24b3c0aec170a7087f910c2a33df02d6504319612cb7c1294c55e042d3454b25fa9f0b8c681a1de51439e3d77d526895f90a1d0038622e5878a19f4f54d09ce361bea72376f8bb26cb9a8bd9005b240d6bc6f76ac430ee15747ab8636836878a5472cf279f45ab1c63a74968c011f60b8cb36c8bf8cd5944a7da2ca29109caa35b78f7f328f68ef99b84e34131c481e79f12f8069ca3a80fa436c9b48cffe8722bc94992c3342a5d2885beab23fbd3b452abbfbf86f8ef7f3e542c6a455fab4c90be657224e5d99604b9c8f4ce29caa7583353b8b1998022713b6f5c21ce4eefe7973718fec80c74d2cddd8ae25d79387ef6135070fb1c99f2e4f2aeb1ef40d7b41390441fdaf2e619dc8ad11ea073d0aafdf1e9e4a57cb7e2940d9c321a4c7b7ce72439f583c8b312200ddd45dc380a00b05616020e4cccaa86f17201a303775fc6e2b8688dfee0af5e27f9dbae81e5ccac922b47fb7279cf692095c2d19bb6870e053be4de89f86b79ef5f8a3e300cdf8e08d51e18ce914fde5fd60b4318dbeaa2e2abfe583d47027e7d26a08b9e2bb026c68bae740f958ed738f595ba454b5b3d
#TRUST-RSA-SHA256 a72cb10a607325aae497293879f0a2e8f3efe6a1f96f8f63ebf2f1a3f8ced2e6d837b80d79bf39b48cc3762de9b79bb7be3492eb0bbde0bc55d04c09587c46f507ccdf545fffdbced2ef59b5ecae3e7ca77167de90a782a7bde4fd7f2752f07b1165590cd6848e12a93e5bf1d615835d3c7d17334d95f79345e8adb9e0793cf8129d5631617caaa9cc152e1da6b29df5993bfe2cd9867bcdcd747a7c3ea44c539c71bc0382c1fcbb75aef26c2ae0bf4638f098c583d5e840d90be4e13271e61ab3016f78c1809d09467981447e4f58a43fea86bb5cdffab5ddebce5ebfa311cab850dab003916e53b971526748ffb3d0bf6de8b8795281055f8ceffdfc88855f3d1aa31384c124690f0d2a7e4015bd70c2d0efeb4e32e596f79dd0ecee8a7ab06be789c6ccc0a3f7629a68252c7cd15201f42ca88c7d2620629ef28a350751fa21900610c339d1ecc0db712840534bbff4f529693ef96f8dd49109e6f9e2202cf583bc0b8535512b82b1be2d0c12078b9ea427dc630fe7250d6970e7e6b8ae11b7181928ebe1ccf35c34222e081a4114ed88bd3f7df44c16df85e3545f485c570afe69792002a781bcfe014be3f8ed9143579e817eb0bbf4184f786a4e548dc73d2a1e73c6ff99c46def89f185bcaa203689649003e9bdb1dd9c7efd47570c1d9295ed91b9fb2fba449cf8c0a2692524b252eeab5a4e47072c218c92835800f9
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348171);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id("CVE-2026-20211");
  script_xref(name:"CISCO-BUG-ID", value:"CSCws25575");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu26102");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu59400");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-rce-se7bYU57");
  script_xref(name:"IAVA", value:"2026-A-1031");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands
    on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must
    have valid high-privileged administrative credentials. This vulnerability is due to insecure
    deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by
    sending a crafted serialized Java object to an affected device. A successful exploit could allow the
    attacker to obtain user-level access to the underlying operating system and then elevate privileges
    toroot. In single-node deployments, successful exploitation of this vulnerability could cause the
    affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that
    have not already authenticated would be unable to access the network until the node is restored.
    (CVE-2026-20211)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?09f0905b");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws25575");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu26102");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu59400");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCws25575, CSCwu26102, CSCwu59400");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20211");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(502, 77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.1', 'required_patch': '12'},
 {'min_ver': '3.2', 'fix_ver': '3.2', 'required_patch': '11'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '12'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '7'},
 {'min_ver': '3.5', 'fix_ver': '3.5', 'required_patch': '4'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCws25575, CSCwu26102, CSCwu59400',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);