Critical Cisco ISE RCE: Authenticated Attackers Can Gain Root

The National Vulnerability Database (NVD) has disclosed a critical vulnerability, CVE-2026-20186, impacting Cisco Identity Services Engine (ISE). This flaw, rated with a CVSS score of 9.9, permits an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. The initial access requires at least Read Only Admin credentials, which is a significant prerequisite, but the potential for full system compromise makes this a serious issue.

According to the NVD, the root cause lies in insufficient validation of user-supplied input. An attacker could exploit this by crafting and sending a malicious HTTP request to the vulnerable ISE instance. A successful exploit could initially grant user-level access, which could then be escalated to root privileges. Furthermore, in single-node ISE deployments, a successful attack could lead to a denial-of-service (DoS) condition, rendering the node unavailable and preventing unauthenticated endpoints from accessing the network until restoration. This isn’t just a data breach risk; it’s an operational nightmare waiting to happen.