Is CVE-2026-20307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20307 being exploited in the wild.

How severe is CVE-2026-20307?

Critical severity, with a CVSS score of 9.9, published 16 September 2026.

Is there a fix for CVE-2026-20307?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20307 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20307?

Check whether you run Cisco Identity Services Engine. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20307: Cisco Identity Services Engine RCE via deserialization in management interface

CVE-2026-20307 · Severity: critical · CVSS 9.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is a network access control solution used to authenticate and manage devices connecting to corporate networks. A critical flaw in its web-based management interface allows authenticated administrators with low privileges to execute arbitrary code on the device and gain root access. Successful exploitation could also render single-node ISE deployments unavailable, preventing network access for unauthenticated endpoints until service is restored.

Technologies: Cisco Identity Services Engine. Vendors: Cisco.

Quick answers

Is CVE-2026-20307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20307 being exploited in the wild.
How severe is CVE-2026-20307?: Critical severity, with a CVSS score of 9.9, published 16 September 2026.
Which products and versions are affected?: Cisco Identity Services Engine.
Is there a fix for CVE-2026-20307?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20307 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20307?: Check whether you run Cisco Identity Services Engine. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-20307 is an insecure Java deserialization vulnerability (CWE-502) in Cisco ISE's web-based management interface. An attacker with low-privileged administrative credentials can exploit this by sending a crafted serialized Java object to the affected device. The vulnerability allows remote, unauthenticated code execution with no user interaction required (CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). A successful exploit grants arbitrary code execution and privilege escalation to root, potentially causing complete device compromise or denial of service in single-node deployments. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

Cisco Identity Services Engine

Timeline

2026-09-16: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.