CVE-2026-20136: Cisco ISE command injection in CLI

CVE-2026-20136 · Severity: medium · CVSS 6 · Published 2026-04-15

Cisco Identity Services Engine (ISE), a platform used to manage secure network access, contains a security flaw in its command-line interface. An authorized administrator with local access could exploit this flaw to gain full control (root access) over the underlying operating system. While this requires existing administrative credentials, a successful attack could allow a user to bypass intended security restrictions and compromise the integrity of the identity management system.

Technologies: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-20136 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20136 being exploited in the wild.
How severe is CVE-2026-20136?
Medium severity, with a CVSS score of 6, published 15 April 2026.
Which products and versions are affected?
Cisco Identity Services Engine 3.3 and earlier, 3.4, 3.5; Cisco ISE Passive Identity Connector 3.3 and earlier, 3.4, 3.5.
Is there a fix for CVE-2026-20136?
A patch was published on 2026-04-15: Fixed releases 3.3 Patch 11, 3.4 Patch 6, and 3.5 Patch 3 made available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20136 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-20136?
Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the Command Line Interface (CLI) of Cisco ISE and ISE-PIC due to improper encoding or escaping of output (CWE-116) and insufficient validation of user-supplied input. An attacker with local access and high administrative privileges (PR:H) can exploit this by providing crafted input to specific CLI commands. Successful exploitation allows the execution of arbitrary commands on the underlying Linux operating system with root-level privileges. Cisco has released fixed software versions (3.3 Patch 11, 3.4 Patch 6, and 3.5 Patch 3) to address this issue; no workarounds are available.

Affected products

  • Cisco Identity Services Engine (ISE) 3.3 and earlier, 3.4, 3.5
  • Cisco ISE Passive Identity Connector (ISE-PIC) 3.3 and earlier, 3.4, 3.5

Timeline

  • 2026-04-15: advisory: Initial public release of Cisco advisory cisco-sa-ise-cmd-inj-5WSJcYJB
  • 2026-04-15: patched: Fixed releases 3.3 Patch 11, 3.4 Patch 6, and 3.5 Patch 3 made available.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.