Critical Cisco ISE RCE: Authenticated Admin Can Achieve Root

The National Vulnerability Database (NVD) has flagged CVE-2026-20147, a critical remote code execution (RCE) vulnerability impacting Cisco ISE and Cisco ISE-PIC. This flaw allows an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. The kicker? The attacker needs valid administrative credentials to pull this off, which is a significant hurdle, but not insurmountable for a determined adversary.

According to the NVD, the vulnerability stems from insufficient validation of user-supplied input. An attacker could exploit this by crafting and sending a malicious HTTP request. A successful exploit grants user-level access to the OS, which can then be escalated to root. In single-node ISE deployments, this vulnerability isn’t just an RCE risk; successful exploitation could lead to the ISE node becoming unavailable, effectively creating a denial-of-service (DoS) condition. This means endpoints not already authenticated would be locked out of the network until the node is restored. With a CVSS score of 9.9, this is as critical as it gets, demanding immediate attention.