Command Injection Vulnerability in Cisco Identity Services Engine and ISE-PIC

CVE-2026-20136

What is CVE-2026-20136?

A command injection vulnerability exists in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). An authenticated local attacker with administrative privileges can exploit this flaw by sending specially crafted input to a specific CLI command. This leads to insufficient validation of the user-supplied input, enabling the attacker to execute commands on the underlying operating system and potentially elevate their privileges to root, resulting in significant unauthorized access.

References