Security Advisory Desk
criticalQCS priority 100/100Cisco

Cisco Identity Services Engine Remote Code Execution Vulnerabilities

Cisco Identity Services Engine (ISE), a network security device, has several security weaknesses that let someone with administrator access run malicious software remotely. This can lead to full control of the device and disrupt network access. Cisco has released updates to fix these issues, and no workarounds exist. Users should promptly apply these updates to protect their systems.

Published 16/9/2026, 4:00:00 pmVerified 17/9/2026, 2:57:05 pmRevision 1
Cisco critical network security advisory visual

In plain language

What this advisory means

Cisco Identity Services Engine (ISE), a network security device, has several security weaknesses that let someone with administrator access run malicious software remotely. This can lead to full control of the device and disrupt network access. Cisco has released updates to fix these issues, and no workarounds exist. Users should promptly apply these updates to protect their systems.

Technical explanation

How the issue affects the environment

Multiple critical remote code execution (RCE) vulnerabilities affect Cisco ISE, exploitable by authenticated attackers with administrative privileges. These include insecure deserialization of Java objects and insufficient validation of user input, allowing arbitrary command execution on the underlying OS with root privileges. Exploitation may also cause denial of service (DoS) in single-node deployments, denying network access to new endpoints until recovery. Software updates addressing CVE-2026-20176, CVE-2026-20211, and CVE-2026-20307 have been released. No mitigations or workarounds are available; upgrades are strongly recommended.

Operational impact

Why teams should care

Successful exploitation leads to complete compromise of the Cisco ISE device, enabling attackers to execute arbitrary code at root level. This jeopardizes network security and management, potentially causing network outages due to node unavailability. The impact can disrupt business operations reliant on network access and identity services, posing a critical operational and security risk.

Immediate action

Cisco strongly recommends upgrading Cisco ISE to the fixed software releases listed in this advisory to remediate these vulnerabilities. Users should consult Cisco upgrade guides and ensure devices meet requirements before updating. No temporary workarounds are available, so timely upgrade is crucial.

Affected and fixed releases

Affected versionsEarlier than 3.1, 3.1, 3.2, 3.3, 3.4, 3.5
Fixed versions3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4

Temporary risk reduction

No workarounds are available to address these vulnerabilities. Users must apply official software updates to remediate the issue.

Evidence and validation checklist

  • Cisco Security Advisory cisco-sa-ise-rce-se7bYU57 published 2026-09-16
  • CVE identifiers CVE-2026-20176, CVE-2026-20211, CVE-2026-20307 documented by Cisco
  • Vulnerability details of insecure deserialization and insufficient input validation
  • Confirmed requirement of authentication with administrative privileges to exploit
  • Cisco has released fixed software patches with version details
  • No workarounds available confirmed by Cisco
  • No public exploitation reported by Cisco PSIRT

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source