Is CVE-2026-20181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20181 being exploited in the wild.

How severe is CVE-2026-20181?

Critical severity, with a CVSS score of 9.1, published 17 June 2026.

Which products and versions are affected?

Cisco Identity Services Engine 3.1, 3.2, 3.3 (prior to Patch 11), 3.4 (prior to Patch 6), 3.5 (prior to Patch 4).

Is there a fix for CVE-2026-20181?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20181 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20181?

Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20181: Cisco ISE and ISE-PIC command injection in underlying OS

CVE-2026-20181 · Severity: critical · CVSS 9.1 · Published 2026-06-17

Cisco Identity Services Engine (ISE) is a security policy management platform that controls access to corporate networks. A vulnerability in this system could allow an administrator to bypass security restrictions and take full control of the underlying server. This could lead to a total service outage, preventing new users or devices from connecting to the network, and potentially allowing an attacker to access sensitive internal data.

Technologies: Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-20181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20181 being exploited in the wild.
How severe is CVE-2026-20181?: Critical severity, with a CVSS score of 9.1, published 17 June 2026.
Which products and versions are affected?: Cisco Identity Services Engine 3.1, 3.2, 3.3 (prior to Patch 11), 3.4 (prior to Patch 6), 3.5 (prior to Patch 4).
Is there a fix for CVE-2026-20181?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20181 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20181?: Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Cisco ISE and ISE-PIC (CVE-2026-20181) stems from insufficient validation of user-supplied input in HTTP requests, specifically related to path traversal (CWE-22). An authenticated, remote attacker with valid administrative credentials can exploit this by sending a crafted HTTP request to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system, initially with user-level access and subsequently escalating to root privileges. In single-node deployments, this can lead to a complete Denial of Service (DoS) for network authentication services. Cisco has released software updates to address this issue; no workarounds are available.

Affected products

Cisco Identity Services Engine (ISE) 3.1, 3.2, 3.3 (prior to Patch 11), 3.4 (prior to Patch 6), 3.5 (prior to Patch 4)
Cisco ISE Passive Identity Connector (ISE-PIC) 3.1, 3.2, 3.3, 3.4

Timeline

2026-06-17: advisory: Initial public release by Cisco
2026-06-19: other: Advisory updated to clarify hot patch availability

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.