Critical Cisco ISE RCE: Authenticated Attackers Can Gain Root

A critical vulnerability, tracked as CVE-2026-20180, has been identified in Cisco Identity Services Engine (ISE). According to the National Vulnerability Database, this flaw could enable an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. The kicker? An attacker only needs Read Only Admin credentials to kick off the exploit chain.

This isn’t just a run-of-the-mill bug; it’s a serious input validation deficiency. By sending a specially crafted HTTP request, an attacker could initially gain user-level access to the OS, then pivot to root privileges. For single-node ISE deployments, successful exploitation could even lead to a denial of service (DoS) condition, effectively taking the node offline. This means any endpoints not already authenticated would be locked out of the network until the node is back online. With a CVSS score of 9.9, this is definitely one to lose sleep over if you’re running vulnerable ISE instances.