Is CVE-2026-20352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20352 being exploited in the wild.

How severe is CVE-2026-20352?

High severity, with a CVSS score of 8.6, published 16 September 2026.

Which products and versions are affected?

Cisco Identity Services Engine 3.2 through 3.5 (before patch versions).

Is there a fix for CVE-2026-20352?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20352 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20352?

Check whether you run Cisco Identity Services Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20352: Cisco Identity Services Engine RADIUS denial of service

CVE-2026-20352 · Severity: high · CVSS 8.6 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is an authentication and access control platform used to manage network access for corporate devices and users. A vulnerability in its RADIUS authentication feature allows an unauthenticated attacker to remotely crash ISE nodes by sending malformed RADIUS requests, causing network authentication services to go offline. In single-node deployments, this prevents any new devices from connecting to the network until the service restarts.

Technologies: Cisco Identity Services Engine. Vendors: Cisco.

Quick answers

Is CVE-2026-20352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20352 being exploited in the wild.
How severe is CVE-2026-20352?: High severity, with a CVSS score of 8.6, published 16 September 2026.
Which products and versions are affected?: Cisco Identity Services Engine 3.2 through 3.5 (before patch versions).
Is there a fix for CVE-2026-20352?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20352 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20352?: Check whether you run Cisco Identity Services Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a buffer overflow vulnerability (CWE-119) in the RADIUS request handler of Cisco ISE Policy Service Nodes. An unauthenticated, remote attacker can send a crafted RADIUS packet to trigger the overflow, causing denial of service. The vulnerability requires no authentication or user interaction and affects RADIUS-enabled nodes on the network layer (AV:N). The ISE node becomes unavailable until manual recovery or automatic restart. Patches are available for ISE versions 3.2 through 3.5 (3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4); versions 3.1 and earlier are not vulnerable.

Affected products

Cisco Identity Services Engine 3.2 through 3.5 (before patch versions)

Timeline

2026-09-16: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-RADIUS-dos-wR3hYPMw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.