Report feedback

An unauthenticated remote attacker can, by sending specially crafted requests to an API endpoint of Cisco Identity Services Engine and Cisco Identity Services Engine Passive Identity Connector that has insufficient authentication checks, gain unauthorized access to the vulnerable device by bypassing the web management interface [25]. The vulnerability is already being actively exploited [26]. IoCs can be found at [25].

The vulnerability is present in products:

• Cisco ISE; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 4;
• Cisco ISE-PIC; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-76460 at cve.org, NVD
• CWE-684: Incorrect Use of Privileged APIs at cwe.mitre.org

The vulnerability was publicly disclosed 16. 9. 2026.

An unauthenticated remote attacker can, by sending a specially crafted HTTP request to the exposed REST API port of Cisco Identity Services Engine and Cisco Identity Services Engine Passive Identity Connector, gain access with administrator privileges and thus read and modify the Identity Services Engine configuration and identity data on the vulnerable device without authorization [22].

The vulnerability is present in products:

• Cisco ISE; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 4;
• Cisco ISE-PIC; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

More information:

• CVE-2026-76423 at cve.org, NVD
• CWE-290: Authentication Bypass by Spoofing at cwe.mitre.org

The vulnerability was publicly disclosed 18. 9. 2026.

An authenticated remote attacker with at least low-level administrative privileges can, by sending a specially crafted serialized Java object to the web interface of a vulnerable Cisco Identity Services Engine device, execute arbitrary code, gain root privileges and, in the case of a single-node deployment, additionally cause a DoS [23].

The vulnerability is present in product:

• Cisco ISE; <3.1; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-20307 at cve.org, NVD
• CWE-502: Deserialization of Untrusted Data at cwe.mitre.org

The vulnerability was publicly disclosed 16. 9. 2026.

An authenticated remote attacker can, provided that they have valid administrator privileges, the SXP service is enabled and at least one SXP connection is configured, perform an SQLi attack on the SXP REST API of Cisco Identity Services Engine, which can give them unauthorized read and write access to the database of the vulnerable device and, if the device is deployed in single-node mode, also allow them to cause a DoS [21].

The vulnerability is present in product:

• Cisco ISE; <3.1; >=3.1, <3.1 Patch 12; >=3.2, <3.2 Patch 11; >=3.3, <3.3 Patch 12; >=3.4, <3.4 Patch 7; >=3.5, <3.5 Patch 4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-20284 at cve.org, NVD
• CWE-943: Improper Neutralization of Special Elements in Data Query Logic at cwe.mitre.org

The vulnerability was publicly disclosed 16. 9. 2026.

An authenticated remote attacker who holds valid administrator privileges on a managed Cisco Secure Firewall Threat Defense device can, by sending a specially crafted sftunnel RPC request, exploit insecure deserialization of data and gain unauthorized root privileges on the vulnerable device running Cisco Secure Firewall Management Center Software, as well as on the device paired with it in high-availability mode [14]. To determine whether your device is running a vulnerable software version, please use the Cisco Software Checker [27].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-20341 at cve.org, NVD
• CWE-502: Deserialization of Untrusted Data at cwe.mitre.org

The vulnerability was publicly disclosed 16. 9. 2026.

An authenticated remote attacker can, due to improper validation of input data in Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software, potentially compromise the confidentiality and integrity of the system or cause a DoS [17].

The vulnerability is present in products:

• Cisco Secure Firewall ASA Software; <9.16; >=9.16, <9.16.4.103; >=9.18, <9.18.4.94; >=9.20, <9.20.4.49; >=9.22, <9.22.3.26; >=9.23, <9.23.1.47; >=9.24, <9.24.1.26;
• Cisco Secure FTD Software; <7.0; >=7.0, <7.0.10; >=7.2, <7.2.12; >=7.4, <7.4.8; >=7.6, <7.6.6; >=7.7, <7.7.13; >=10.0, <10.0.2; >=10.1, <10.1.0;
• Cisco Secure FMC Software; <7.0; >=7.0, <7.0.10; >=7.2, <7.2.12; >=7.4, <7.4.8; >=7.6, <7.6.6; >=7.7, <7.7.13; >=10.0, <10.0.2; >=10.1, <10.1.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-20330 at cve.org, NVD
• CWE-707: Improper Neutralization at cwe.mitre.org

The vulnerability was publicly disclosed 16. 9. 2026.