Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the createDBLink method. The issue results from the lac...

Cisco Identity Services Engine (cisco-sa-ISE-ABP-VNSW7Tn5)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. CVE-2026-76460 Please see the included Cisco BIDs and Cisco Security Adviso...

Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the AlarmMessageDiskQueue class. The issue results from the lack of proper...

Vulnerabilities found in Cisco Identity Services Engine (ISE)

Cisco has identified 21 vulnerabilities in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC. These vulnerabilities concern various security issues in Cisco ISE and ISE-PIC, including opportunities for unauthorized and low-privilege malicious actors to perform...

The vulnerability in the application software interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Cisco Identity Services Engine ISE management platform is related to errors that occur when privileged application programming interfaces are used. Exploiting this vulnerability can allow a malicious actor to bypass existing securi...

CVE-2026-20352

A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this...

CVE-2026-20309

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20235

A vulnerability in the API of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient...

CVE-2026-20287

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by improper privilege management vulnerabilities (grouped under CWE-269 ), discovered internally during a security hardening review. The CVSS 3.1 score is 6.5 (Medium) , with a vector of AV:N/AC:L...

CVE-2026-20287 Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-20286

Cisco Identity Services Engine (ISE) has an authorization bypass vulnerability in its web-based management interface . The root cause is the lack of server-side validation of Administrator permissions , allowing an authenticated, remote attacker with valid Administrator credentials to submit a cr...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76448

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by an SQL/HQL injection vulnerability caused by insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated remote attacker with v...

CVE-2026-76434

Cisco ISE and Cisco ISE-PIC contain an arbitrary file read vulnerability in the certificate import functionality of their web-based management interface. The root cause is insufficient validation of user-supplied input , allowing an authenticated, remote attacker with administrative credentials t...

CVE-2026-20235

Cisco Identity Services Engine (ISE) contains an information disclosure vulnerability in its API , caused by insufficient validation of user-supplied parameters in API requests. An authenticated remote attacker with valid administrative credentials can send a crafted API request to view sensitive...

CVE-2026-76449

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by an SQL or HQL injection vulnerability caused by insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated remote attacker wit...

CVE-2026-76450 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

EUVD-2026-81146

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20309 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...