This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 15 vulnerabilities

Cisco fixes 15 vulnerabilities in its products. The most severe of them are described below; the rest can be found at [1][2][3][4][5][6][7][8][9][10]. Fixed versions of individual products: Cisco Identity Services Engine (ISE) [1][2][3][4] - 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 Cisco ISE Passive Identity Connector (ISE-PIC) [1][3] - 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 Cisco AsyncOS Software for Cisco Secure Web Appliance [5] - 15.2.5-013 Cisco ThousandEyes Enterprise Agent [6] - 1.234.0 Cisco Unity Connection [7][8] - 15SU4, 14SU6 Cisco Webex Services [9][10] - fixed in the cloud

Cisco ISE & ISE-PIC - RCE, privilege escalation, DoS (CVE-2026-20147)
CVSS 9.9 (Critical)

An authenticated remote attacker with an administrator account in Cisco ISE or ISE-PIC can elevate their privileges to root and execute code by sending specially crafted HTTP requests [1]. In single-node ISE deployments, the attacker can also carry out a DoS attack.

The vulnerability is present in products:

  • Cisco Identity Services Engine; <3.1 Patch 11; >=3.2, <3.2 Patch 10; >=3.3, <3.3 Patch 11; >=3.4, <3.4 Patch 6; >=3.5, <3.5 Patch 3;
  • Cisco Identity Services Engine Passive Identity Connector; <3.1 Patch 11; >=3.2, <3.2 Patch 10; >=3.3, <3.3 Patch 11; >=3.4, <3.4 Patch 6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-20147 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 4. 2026.

Cisco ISE - OS commands execution, privilege escalation, DoS (CVE-2026-20180, CVE-2026-20186)
CVSS 9.9 (Critical)

An authenticated remote attacker with a Read Only Admin account in Cisco ISE can elevate their privileges to root and execute commands at the operating system level by sending specially crafted HTTP requests [2]. In single-node ISE deployments, the attacker can also carry out a DoS attack.

The vulnerability is present in product:

  • Cisco Identity Services Engine; <3.2 Patch 8; >=3.3, <3.3 Patch 8; >=3.4, <3.4 Patch 4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 4. 2026.

Cisco Webex Services - unauthorized access (CVE-2026-20184)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can, under certain conditions, impersonate any user within the Cisco Webex service due to insufficient certificate validation in the SSO (Single Sign-On) integration when communicating with Control Hub [9].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 4. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 6. 5. 2026.

CESNET, z.s.p.o. Logo