CVE-2026-20287 Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20287

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by improper privilege management vulnerabilities (grouped under CWE-269 ), discovered internally during a security hardening review. The CVSS 3.1 score is 6.5 (Medium) , with a vector of AV:N/AC:L...

CVE-2026-20287 Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-20286 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20286

Cisco Identity Services Engine (ISE) has an authorization bypass vulnerability in its web-based management interface . The root cause is the lack of server-side validation of Administrator permissions , allowing an authenticated, remote attacker with valid Administrator credentials to submit a cr...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76448 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76448

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by an SQL/HQL injection vulnerability caused by insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated remote attacker with v...

CVE-2026-76434

Cisco ISE and Cisco ISE-PIC contain an arbitrary file read vulnerability in the certificate import functionality of their web-based management interface. The root cause is insufficient validation of user-supplied input , allowing an authenticated, remote attacker with administrative credentials t...

CVE-2026-76451 Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-20235

Cisco Identity Services Engine (ISE) contains an information disclosure vulnerability in its API , caused by insufficient validation of user-supplied parameters in API requests. An authenticated remote attacker with valid administrative credentials can send a crafted API request to view sensitive...

CVE-2026-20235 Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in the API of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient...

CVE-2026-76449

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by an SQL or HQL injection vulnerability caused by insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated remote attacker wit...

CVE-2026-76449 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76450 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

EUVD-2026-81146

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20309 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20309 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20309

Cisco Identity Services Engine (ISE) contains a reflected cross-site scripting (XSS) vulnerability in its web-based management interface. The root cause is improper validation of user-supplied input , allowing an unauthenticated, remote attacker to craft a malicious link that, when clicked by a u...