Is CVE-2026-20147 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20147 being exploited in the wild.

How severe is CVE-2026-20147?

Critical severity, with a CVSS score of 9.9, published 15 April 2026.

Which products and versions are affected?

Cisco Identity Services Engine 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6, 3.5 before Patch 3; Cisco Identity Services Engine Passive Identity Connector 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6.

Is there a fix for CVE-2026-20147?

A patch was published on 2026-04-28: Updated fixed release availability information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20147 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20147?

Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20147: Cisco ISE command injection in underlying operating system

CVE-2026-20147 · Severity: critical · CVSS 9.9 · Published 2026-04-15

Cisco Identity Services Engine (ISE), a platform used to manage secure network access for users and devices, contains a vulnerability that could allow an attacker to take full control of the system. An attacker with valid administrative credentials can execute malicious commands to gain root-level access, potentially stealing sensitive data or causing a total network outage. In certain setups, this could prevent all new users and devices from connecting to the corporate network until the system is restored.

Technologies: Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-20147 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20147 being exploited in the wild.
How severe is CVE-2026-20147?: Critical severity, with a CVSS score of 9.9, published 15 April 2026.
Which products and versions are affected?: Cisco Identity Services Engine 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6, 3.5 before Patch 3; Cisco Identity Services Engine Passive Identity Connector 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6.
Is there a fix for CVE-2026-20147?: A patch was published on 2026-04-28: Updated fixed release availability information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20147 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20147?: Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability (CWE-77) exists in Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input in HTTP requests. An authenticated, remote attacker with valid administrative credentials can exploit this by sending a crafted HTTP request to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with user-level privileges and subsequently elevate those privileges to root. In single-node deployments, this can lead to a denial of service (DoS) where new endpoints are unable to authenticate to the network. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

Cisco Identity Services Engine (ISE) 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6, 3.5 before Patch 3
Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6

Timeline

2026-04-15: advisory: Initial public release by Cisco
2026-04-28: patched: Updated fixed release availability information

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.