cyber.hendryadrian.com
Vulnerability & Exploit · thecyberexpress.com

Cisco Patches ISE and Webex Flaws That Could Enable RCE and User Impersonation

· Original article ↗

Summary

Cisco patched three ISE vulnerabilities that could enable command execution and privilege escalation, plus a Webex SSO flaw that could allow user impersonation. Cisco reported no known exploitation; no workarounds are available.

Key points

  • CVE-2026-20147 affects Cisco ISE versions 3.5 and earlier; an authenticated attacker with administrative credentials could execute commands and escalate privileges to root.
  • CVE-2026-20180 and CVE-2026-20186 affect ISE versions 3.4 and earlier; attackers with read-only administrative access could execute commands.
  • CVE-2026-20184 affects Webex Services deployments using SSO with Control Hub; improper certificate validation could let an unauthenticated remote attacker impersonate users.
  • Cisco said it was not aware of public exploitation or malicious use when the flaws were disclosed.
  • No workarounds are available. Cisco released fixed versions, and systems earlier than ISE 3.1 should migrate to a supported release.
  • Cisco warned that exploitation in single-node ISE deployments could prevent new endpoints from authenticating.

Article Details

Vulnerability Types
  • Insufficient validation of user-supplied input
  • Improper certificate validation
Severity
Critical; CVSS 9.9 for the ISE vulnerabilities and 9.8 for the Webex Services vulnerability
Affected Versions
  • Cisco ISE 3.5 and earlier (CVE-2026-20147)
  • Cisco ISE 3.4 and earlier (CVE-2026-20180 and CVE-2026-20186)
  • Cisco ISE-PIC systems, regardless of configuration
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe ISE vulnerabilities could allow attackers with administrative or read-only administrative access to execute commands and escalate privileges to root.

CVE

CVE-2026-20147Cisco · Cisco Identity Services Engine Software; Cisco · Cisco ISE Passive Identity ConnectorCritical ISE flaws (including CVE-2026-20147) can allow authenticated attackers to execute arbitrary commands and gain root access.CVE-2026-20180Cisco · Cisco Identity Services Engine SoftwareTwo additional ISE vulnerabilities (CVE-2026-20180 and CVE-2026-20186) let attackers with limited privileges execute commands and escalate access.CVE-2026-20184Cisco · Cisco Webex MeetingsThe Webex Services bug (CVE-2026-20184) in SSO certificate validation could allow unauthenticated attackers to impersonate any user.CVE-2026-20186Cisco · Cisco Identity Services Engine SoftwareTwo additional ISE vulnerabilities (CVE-2026-20180 and CVE-2026-20186) let attackers with limited privileges execute commands and escalate access.

People

Jonathan LeinThe article identifies him as the person who reported the issues, associated with TrendAI Research.

Vendors

CiscoCisco has released patches for critical vulnerabilities in Identity Services Engine (ISE) and Webex Services that could enable remote code execution, root-level access, and user impersonation.

Products

Cisco ISECisco has released patches for critical vulnerabilities in Identity Services Engine (ISE) and Webex Services that could enable remote code execution, root-level access, and user impersonation.Control HubTracked as CVE-2026-20184 with a CVSS score of 9.8, the flaw affects single sign-on integration with Control Hub.Passive Identity Connector (ISE-PIC)The most severe issues impact Cisco Identity Services Engine (ISE) and its Passive Identity Connector (ISE-PIC).Webex ServicesCisco has released patches for critical vulnerabilities in Identity Services Engine (ISE) and Webex Services that could enable remote code execution, root-level access, and user impersonation.

Related Articles