New Vulnerabilities Patched in Cisco Products

Affected Environment

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), all releases regardless of device configuration. Note: Cisco ISE-PIC has reached end-of-sale; release 3.4 is the last supported release.

Threat Overview

Cisco disclosed two vulnerabilities affecting Cisco ISE and ISE-PIC. The vulnerabilities could allow a remote attacker to achieve remote code execution or conduct information disclosure attacks. Successful exploitation of the RCE vulnerability could allow an authenticated remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system, elevate privileges to root, and in single-node deployments trigger a denial of service condition. The information disclosure vulnerability allows unauthenticated attackers to access sensitive data including hashed credentials.

Exposure Timeline

Advisories issued 22 June 2026. No active exploitation confirmed at time of publication. Cisco has indicated no workarounds are available for either vulnerability. The recommended remediation window is ten working days.

Attack Surface

For CVE-2026-20181, the attacker must have valid administrative credentials. For CVE-2026-20190, the attack is unauthenticated and accessible via the network to any attacker who can send crafted traffic to the affected device.

Technical Root Cause

CVE-2026-20181 (CVSS 9.1) - A vulnerability in Cisco ISE and ISE-PIC due to insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system via a crafted HTTP request. The attacker can initially obtain user-level OS access and then elevate privileges to root. In single-node deployments, successful exploitation can cause the ISE node to become unavailable, resulting in a denial of service condition and preventing unauthenticated endpoints from accessing the network until the node is restored.

CVE-2026-20190 (CVSS 7.5) - A vulnerability in Cisco ISE and ISE-PIC due to improper authorization checks when a resource is accessed allows an unauthenticated remote attacker to view sensitive information including hashed credentials by sending crafted traffic to an affected device. The hashed credentials obtained could be used to mount further attacks.

Exploitation Pathway

For CVE-2026-20181, an authenticated administrator sends a crafted HTTP request to the ISE interface, triggering the command injection and escalating to root. In single-node environments this also causes a DoS. For CVE-2026-20190, an unauthenticated attacker sends crafted network traffic to the ISE device and retrieves sensitive configuration data and hashed credentials without any authentication required.