CVE-2026-20180 Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability

Critical 9.9 Published 15 Apr 2026 Updated 16 Apr 2026

Authenticated attackers can execute arbitrary commands and escalate privileges to root on Cisco ISE via crafted HTTP requests.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20180?

CVE-2026-20180 is a critical command injection vulnerability in Cisco Identity Services Engine, published on 15 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Weakness: CWE-22

Which versions are affected by CVE-2026-20180?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2026-20180?

No fix has been published for CVE-2026-20180 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-20180 being exploited?

There is no known exploitation of CVE-2026-20180 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-6fqc-22r3-wrxm.