Quick answers
- Is CVE-2026-20130 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20130 being exploited in the wild.
- How severe is CVE-2026-20130?
- Critical severity, with a CVSS score of 10, published 16 September 2026.
- Which products and versions are affected?
- Cisco Identity Services Engine 3.0 and earlier, 3.1 before 3.1 Patch 12, 3.2 before 3.2 Patch 11, 3.3 before 3.3 Patch 12, 3.4 before 3.4 Patch 7, 3.5 before 3.5 Patch 4; Cisco Identity Services Engine Passive Identity Connector 3.4 and earlier.
- Is there a fix for CVE-2026-20130?
- A patch was published on 2026-09-16: Fixed releases available for all supported versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20130 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-20130?
- Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output) and encompasses command injection, cross-site scripting (XSS), XML injection, code injection, and resource injection attacks. The root cause stems from insufficient input validation and output encoding in the ISE and ISE-PIC components. These flaws are exploitable over the network without requiring authentication or user interaction, with the impact scoped to the confidentiality, integrity, and availability of the entire system and connected infrastructure. Cisco has released patched versions for all supported release branches, with no workarounds available; immediate patching is required for affected deployments.
Affected products
- Cisco Identity Services Engine 3.0 and earlier, 3.1 before 3.1 Patch 12, 3.2 before 3.2 Patch 11, 3.3 before 3.3 Patch 12, 3.4 before 3.4 Patch 7, 3.5 before 3.5 Patch 4
- Cisco Identity Services Engine Passive Identity Connector 3.4 and earlier
Timeline
- 2026-09-16: disclosed
- exploited: One related vulnerability is known to be actively exploited
- 2026-09-16: patched: Fixed releases available for all supported versions