Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-20136

Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying operating system and elevate privileges to root. This vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by providing crafted input to a specific CLI command. A successful exploit could allow the attacker to elevate their privileges to root on the underlying operating system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Identity Services Engine Software

Default version status: unknown

  • 3.1.0affected
  • 3.1.0 p1affected
  • 3.1.0 p3affected
  • 3.1.0 p2affected
  • 3.2.0affected
  • 3.1.0 p4affected
  • 3.1.0 p5affected
  • 3.2.0 p1affected
  • 3.1.0 p6affected
  • 3.2.0 p2affected
  • 3.1.0 p7affected
  • 3.3.0affected
  • 3.2.0 p3affected
  • 3.2.0 p4affected
  • 3.1.0 p8affected
  • 3.2.0 p5affected
  • 3.2.0 p6affected
  • 3.1.0 p9affected
  • 3.3 Patch 2affected
  • 3.3 Patch 1affected
  • 3.3 Patch 3affected
  • 3.4.0affected
  • 3.2.0 p7affected
  • 3.3 Patch 4affected
  • 3.4 Patch 1affected
  • 3.1.0 p10affected
  • 3.3 Patch 5affected
  • 3.3 Patch 6affected
  • 3.4 Patch 2affected
  • 3.3 Patch 7affected
  • 3.4 Patch 3affected
  • 3.5.0affected
  • 3.4 Patch 4affected
  • 3.3 Patch 8affected
  • 3.2 Patch 8affected
  • 3.5 Patch 1affected
  • 3.3 Patch 9affected
  • 3.2 Patch 9affected
  • 3.4 Patch 5affected
  • 3.5 Patch 2affected
  • 3.3 Patch 10affected

References