# CVE-2026-20147: Cisco ISE command injection in underlying operating system

Source: https://junglewise.ai/threats/cve-2026-20147-cisco-ise-command-injection-in-underlying-operating-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-20147 · Severity: critical · CVSS 9.9 · Published 2026-04-15

Cisco Identity Services Engine (ISE), a platform used to manage secure network access for users and devices, contains a vulnerability that could allow an attacker to take full control of the system. An attacker with valid administrative credentials can execute malicious commands to gain root-level access, potentially stealing sensitive data or causing a total network outage. In certain setups, this could prevent all new users and devices from connecting to the corporate network until the system is restored.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco Identity Services Engine Passive Identity Connector](https://junglewise.ai/threats/technologies/identity-services-engine-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20147 being exploited in the wild.

**How severe is CVE-2026-20147?** Critical severity, with a CVSS score of 9.9, published 15 April 2026.

**Which products and versions are affected?** Cisco Identity Services Engine 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6, 3.5 before Patch 3; Cisco Identity Services Engine Passive Identity Connector 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6.

**Is there a fix for CVE-2026-20147?** A patch was published on 2026-04-28: Updated fixed release availability information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20147 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20147?** Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-77) exists in Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input in HTTP requests. An authenticated, remote attacker with valid administrative credentials can exploit this by sending a crafted HTTP request to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with user-level privileges and subsequently elevate those privileges to root. In single-node deployments, this can lead to a denial of service (DoS) where new endpoints are unable to authenticate to the network. Cisco has released software updates to address this vulnerability; no workarounds are available.

## Affected products

- Cisco Identity Services Engine (ISE) 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6, 3.5 before Patch 3
- Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) 3.1 before Patch 11, 3.2 before Patch 10, 3.3 before Patch 11, 3.4 before Patch 6

## Timeline

- 2026-04-15: advisory: Initial public release by Cisco
- 2026-04-28: patched: Updated fixed release availability information

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)