CVE-2026-20180 · Cisco ISE Authenticated RCE via Path Traversal and Command Injection

01 · The Real Story

Like finding out your building's master key can be copied by anyone with a visitor badge

CVE-2026-20180 is a chained path-traversal (CWE-22) and command-injection (CWE-77) vulnerability in the Cisco Identity Services Engine (ISE) web management interface. An attacker holding even the lowest-tier administrative credential — Read Only Admin — can send a single crafted HTTP request that escapes the intended directory sandbox, injects arbitrary OS commands, and escalates to root on the underlying Linux-based appliance. Affected releases span ISE 3.2 through Patch 7, 3.3 through Patch 7, 3.4 through Patch 3, and all versions earlier than 3.2 (end-of-support, no patch available). ISE 3.5 shipped clean. Cisco published fixes on April 15, 2026 under advisory cisco-sa-ise-rce-4fverepv; a public PoC appeared six days later.

Cisco's CVSS 9.9 CRITICAL rating is essentially correct. The Scope-Changed flag (S:C) is justified because root on the underlying OS breaks out of the ISE application boundary — the attacker doesn't just read dashboards, they own the appliance, its stored RADIUS shared secrets, TACACS+ keys, AD service-account bind passwords, TLS private keys, and the network admission-policy engine itself. The only real-world friction the score overstates is that ISE management interfaces *should* live on a dedicated admin VLAN reachable only through jump hosts — internet exposure is near zero. We adjust the score to 9.1 to reflect that management-plane access constraint, but the verdict stays firmly CRITICAL because ISE is, by definition, a fleet-wide trust anchor and 100% of deployments serve that high-value role.

"Root on your NAC appliance via a helpdesk-tier account. ISE's 9.9 earns its keep."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain ISE Read Only Admin credentials

The attacker acquires valid ISE administrative credentials at the Read Only Admin tier or above. This is the lowest admin role in ISE and is routinely assigned to helpdesk staff, NOC operators, auditors, and service accounts powering SIEM/NMS integrations. Credential theft via phishing, password reuse from a breached monitoring platform, or harvesting from a compromised automation repository all suffice.

Conditions required:

Valid ISE admin credentials (Read Only Admin minimum)
Knowledge that the target runs Cisco ISE

Where this breaks in practice:

No unauthenticated path exists — a valid credential is mandatory
Read Only Admin credentials should be vaulted and rotated, though many orgs treat them as low-sensitivity

Detection/coverage: Failed login attempts visible in ISE System Logs (ise-psc.log). Monitor for brute-force patterns or credential-stuffing against the admin portal (TCP/443).

STEP 02

Reach the ISE management web interface

The attacker must have network-level connectivity to the ISE admin portal on TCP/443. In a well-segmented environment this interface sits on a dedicated management VLAN accessible only from hardened jump hosts. In practice, many enterprises expose ISE management to broader internal subnets or even shared server VLANs. Internet exposure should be effectively zero.

Conditions required:

Network path to ISE management IP on TCP/443

Where this breaks in practice:

Management interface should be ACL-restricted to admin VLAN or jump hosts
ISE management should never be internet-facing per Cisco deployment guides

Detection/coverage: Firewall or NetFlow logs showing connections to ISE management port from non-admin source IPs. Run periodic Shodan/Censys checks against your public IP ranges for ISE admin fingerprints.

STEP 03

Send crafted HTTP request with path-traversal payload

Using the authenticated session, the attacker sends a specially crafted HTTP request to a management endpoint that fails to sanitize directory-traversal sequences (../). The insufficient input validation lets the request escape the intended file-system path. A public PoC (kaleth4/CVE-2026-20180) was released on April 21, 2026 — six days post-disclosure — providing a ready-made weaponization template.

Conditions required:

Authenticated management session from Step 1–2
Knowledge of the vulnerable endpoint (public PoC available)

Where this breaks in practice:

HTTPS inspection on management traffic could flag anomalous path sequences, but ISE management HTTPS is rarely intercepted

Detection/coverage: Qualys QID 317843 detects the vulnerable version (released day-zero). Search ISE access logs and ise-psc.log for ../ path-traversal sequences in request URIs.

STEP 04

Achieve command injection and user-level OS access

The path-traversal primitive chains directly with a command-injection flaw (CWE-77) in the same request, executing arbitrary OS commands in the context of the ISE application's service user. At this stage the attacker has a shell on the underlying RHEL-based appliance and can read ISE configuration files, database contents, and stored secrets. No additional exploit is needed — the injection is part of the same crafted request.

Conditions required:

Successful path traversal from Step 3

Where this breaks in practice:

No additional friction once Step 3 succeeds — traversal and injection are a single atomic operation

Detection/coverage: Unexpected child processes spawned by the ISE Java process (/bin/sh, bash, curl, wget, python) are strong IOCs. Host-based EDR on the ISE appliance would catch this, but ISE appliances rarely run third-party agents.

STEP 05

Escalate to root and own the trust anchor

From user-level OS access the attacker escalates to root — Cisco's advisory explicitly confirms root escalation is achievable as part of this vulnerability. With root, the attacker can extract RADIUS shared secrets, TACACS+ keys, AD service-account credentials, TLS private keys, and manipulate ISE network-access policies to authorize rogue devices or deny legitimate ones. In single-node deployments, exploitation can crash the ISE service entirely, causing a denial-of-service condition that prevents any new endpoint from authenticating to the network.

Conditions required:

User-level OS shell from Step 4

Where this breaks in practice:

Cisco confirms privilege escalation is inherent — no separate exploit required

Detection/coverage: Sudden ISE service restarts, unexpected admin-account creation, configuration-change events in ise-psc.log outside change windows. Monitor AD for authentication anomalies from the ISE service account.

03 · Compensating Control

CRITICAL 9.1→HIGH 7.5

SEVERITY REDUCED

Restrict ISE management interface to dedicated admin VLAN with jump-host-only ACLs — Apply firewall or VLAN ACLs ensuring the ISE admin portal (TCP/443) is reachable only from hardened, MFA-protected jump hosts or PAM gateways. This eliminates the AV:N vector for any attacker not already on the management plane, breaking Step 2 of the attack path. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL findings; apply the vendor patch within the 90-day noisgate remediation SLA. This is the single highest-leverage control short of patching.

CRITICAL 9.1→HIGH 6.5

SEVERITY REDUCED

Enable MFA on the ISE admin portal — Cisco ISE supports RADIUS-based or SAML-based multi-factor authentication for admin logins. Enabling MFA means a stolen Read Only Admin password alone is insufficient — the attacker also needs the second factor, breaking Step 1 of the attack path for credential-only compromise scenarios. Deploy within 3 days.

CRITICAL 9.1→HIGH 7.0

SEVERITY REDUCED

Audit, minimize, and vault all ISE Read Only Admin accounts — Enumerate every ISE admin account. Remove orphaned auditor accounts, unused service accounts, and any shared credentials. Rotate passwords for all remaining accounts and store them in a PAM vault with checkout logging and session recording. This shrinks the credential-theft surface for Step 1. Deploy within 3 days.

CRITICAL 9.1→CRITICAL 8.5

Monitor ISE admin audit logs for path-traversal and anomalous process spawns — Configure SIEM alerting on ISE ise-psc.log and access logs. Alert on: path-traversal sequences (../) in request URIs, admin logins from non-jump-host IPs, and unexpected child processes (/bin/sh, bash, python, curl) spawned by the ISE Java process. This is detective, not preventive — it reduces dwell time but does not block exploitation. Deploy within 3 days.

What doesn't work

WAF in front of ISE management: ISE admin portals are not architected to sit behind a web application firewall. Even if deployed, the exploit uses a legitimate authenticated HTTPS session — most WAF rule sets focus on unauthenticated injection patterns and would not flag an admin-session request carrying traversal sequences in application-layer parameters.
Network IDS/IPS signatures: The exploit payload travels inside a TLS-encrypted authenticated HTTPS session to the management interface. Network-layer inspection cannot see the path-traversal or command-injection content unless you perform full TLS interception on your management VLAN — which most organizations do not do and which introduces certificate-trust complications with the ISE appliance.
Disabling the Read Only Admin role entirely: ISE requires at least one admin account, and Read Only Admin is used by legitimate monitoring, SIEM, and audit workflows. Removing the role breaks operational integrations. The correct control is minimizing and vaulting these accounts, not eliminating the role.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No confirmed exploitation as of 2026-09-26. Not listed on CISA KEV. No GreyNoise tags observed for CVE-2026-20180. However, a sister ISE vulnerability (CVE-2026-76460, unauthenticated) was added to KEV on September 16, 2026, proving ISE is an actively targeted product class.
Proof-of-Concept	Public PoC available since April 21, 2026 — kaleth4/CVE-2026-20180. Released 6 days post-disclosure. Demonstrates path-traversal + command-injection chain. Lowers exploitation barrier from 'researcher-grade' to 'script-kiddie-with-creds'.
EPSS Score	0.06024 (6.02%) — approximately 93rd percentile. Elevated exploitation probability relative to the general CVE population, consistent with public PoC availability and low attack complexity.
KEV Status	Not listed on CISA KEV as of 2026-09-26. The authenticated prerequisite likely suppresses mass exploitation that would trigger KEV inclusion. Monitor for status change given the active PoC.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` (9.9) — Network vector, low complexity, low privilege (Read Only Admin), no user interaction, scope change to underlying OS. The S:C flag is the score driver, reflecting root-level OS compromise beyond the ISE application boundary.
Affected Versions	ISE < 3.2 (end-of-support, no patch), 3.2 through Patch 7, 3.3 through Patch 7, 3.4 through Patch 3. ISE 3.5+ is not affected.
Fixed Versions	ISE 3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4. ISE 3.5 shipped clean. Versions < 3.2 require full migration — no backport available.
Scanner Coverage	Qualys QID 317843 (released April 15, 2026, day-zero coverage). ISE management interfaces have negligible internet exposure per Shodan/Censys; internal scanning via credentialed Qualys/Nessus checks is the primary detection path.
Disclosure Date	2026-04-15 — coordinated disclosure by Cisco. Advisory ID: `cisco-sa-ise-rce-4fverepv`. Companion vulnerability: CVE-2026-20186 (disclosed same date).
Researcher / Reporter	Not publicly credited in Cisco's advisory. Likely discovered through Cisco PSIRT's internal testing or a private responsible-disclosure submission.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.1/10)

Why this verdict

Canonical high-value target (floor = CRITICAL): Cisco ISE is the network access control and identity-policy engine. 100% of ISE deployments serve this trust-anchor role — there is no 'low-value ISE install.' Root on ISE yields RADIUS shared secrets, TACACS+ keys, AD bind credentials, TLS private keys, and fleet-wide network-admission policy control. The blast radius is fleet-scale + identity-scale. Per the high-value-role rule, the verdict floor is CRITICAL.
Role multiplier: ISE occupies the identity/trust and network-policy high-value role in *every* deployment. (a) Low-value role: does not exist for ISE. (b) Typical role: ISE node in a multi-node cluster — root on one node exposes shared secrets and policy replication credentials for the entire cluster. (c) High-value role: single-node ISE or primary admin node — root = full fleet network-access control + DoS that locks out all unauthenticated endpoints. The chain succeeds in all roles once credentials are obtained. Outcome: fleet-scale compromise. Floor: CRITICAL.
Public PoC lowers the bar: A working PoC was published six days after disclosure. Combined with the low-privilege requirement (Read Only Admin — the credential most likely shared with monitoring tools, helpdesk, and auditors), the practical exploitation difficulty is LOW for any attacker with internal network position and a harvested credential.
Management-plane access constraint (−0.8 points): ISE admin portals should be restricted to dedicated management VLANs and jump hosts. Internet exposure is near zero. This meaningfully narrows the attacker population to insiders, compromised monitoring platforms, or post-initial-access operators — not drive-by scanners. This is the sole downward adjustment, taking the score from 9.9 to 9.1.
EPSS and threat-class context: EPSS of 6.02% (~93rd percentile) is elevated. A sister ISE vulnerability (CVE-2026-76460) hit KEV in September 2026, confirming ISE is an active adversary target class. The authenticated requirement may delay mass exploitation but does not prevent targeted attacks by motivated actors.

Why not higher?

The vendor's 9.9 is the theoretical maximum for PR:L with S:C. A 9.9 implies trivially mass-exploitable conditions. In practice, the ISE management interface lives on an internal management VLAN, and the attacker must possess valid admin credentials. These two prerequisites together narrow the attacker population to insiders, compromised service accounts, or post-initial-access operators — not internet-facing drive-by scanners. The 0.8-point reduction to 9.1 accounts for this realistic access constraint while keeping the verdict in the CRITICAL band where the blast radius demands it.

Why not lower?

ISE is not a workstation or a line-of-business app server — it is the network trust anchor for the entire fleet. Downgrading below CRITICAL would require evidence that management-plane restrictions effectively eliminate exploitation, but Read Only Admin credentials are widely distributed (helpdesk, NOC, SIEM integrations, automation service accounts), the PoC is public, and CVE-2026-76460's KEV listing proves ISE is under active adversary interest in 2026. The blast radius of root-on-ISE — fleet-wide network-access manipulation, credential extraction, potential total network DoS in single-node deployments — is categorically incompatible with a HIGH or lower rating.

06 · Verification

Crowdsourced verification payload.

Run from any Linux or macOS workstation with network access to the ISE management API (TCP/443). Requires curl and valid ISE API credentials (Read Only Admin or above). Invoke as: bash check_cve_2026_20180.sh ise-admin.corp.local admin 'P@ssw0rd'. No elevated privileges needed on the workstation; the script queries the ISE deployment API read-only.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# CVE-2026-20180 Vulnerability Checker for Cisco ISE
# Checks ISE software version against known-fixed releases.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 3 ]; then
  echo "Usage: $0 <ISE_HOST> <USERNAME> <PASSWORD>"
  echo "Example: $0 ise-admin.corp.local admin 'P@ssw0rd'"
  exit 2
fi

ISE_HOST="$1"
USERNAME="$2"
PASSWORD="$3"

# Query ISE version via deployment node API
RESPONSE=$(curl -sk --max-time 15 -u "${USERNAME}:${PASSWORD}" \
  -H "Accept: application/json" \
  "https://${ISE_HOST}/api/v1/deployment/node" 2>/dev/null) || true

if [ -z "${RESPONSE:-}" ]; then
  echo "UNKNOWN - Could not connect to ISE API at ${ISE_HOST}"
  exit 2
fi

# Extract softwareVersion field
VERSION=$(echo "$RESPONSE" | grep -oP '"softwareVersion"\s*:\s*"\K[^"]+' | head -1)

if [ -z "${VERSION:-}" ]; then
  echo "UNKNOWN - Could not parse softwareVersion from API response"
  echo "Hint: verify credentials and that ERS/OpenAPI is enabled on this node."
  exit 2
fi

echo "[*] Detected ISE version: $VERSION"

# Parse major.minor and patch number
MAJOR_MINOR=$(echo "$VERSION" | grep -oP '^\d+\.\d+')
PATCH_NUM=$(echo "$VERSION" | grep -oiP 'patch\s*(\d+)' | grep -oP '\d+' || echo "0")

echo "[*] Release: ${MAJOR_MINOR}, Patch level: ${PATCH_NUM}"

case "$MAJOR_MINOR" in
  3.5*|3.6*|4.*)
    echo "PATCHED - ISE ${VERSION} is not affected by CVE-2026-20180."
    exit 0
    ;;
  3.4)
    if [ "$PATCH_NUM" -ge 4 ]; then
      echo "PATCHED - ISE ${VERSION} includes the fix (>= 3.4 Patch 4)."
      exit 0
    else
      echo "VULNERABLE - ISE ${VERSION} is affected. Upgrade to 3.4 Patch 4+."
      exit 1
    fi
    ;;
  3.3)
    if [ "$PATCH_NUM" -ge 8 ]; then
      echo "PATCHED - ISE ${VERSION} includes the fix (>= 3.3 Patch 8)."
      exit 0
    else
      echo "VULNERABLE - ISE ${VERSION} is affected. Upgrade to 3.3 Patch 8+."
      exit 1
    fi
    ;;
  3.2)
    if [ "$PATCH_NUM" -ge 8 ]; then
      echo "PATCHED - ISE ${VERSION} includes the fix (>= 3.2 Patch 8)."
      exit 0
    else
      echo "VULNERABLE - ISE ${VERSION} is affected. Upgrade to 3.2 Patch 8+."
      exit 1
    fi
    ;;
  *)
    echo "VULNERABLE - ISE ${VERSION} is end-of-support and affected."
    echo "No patch available. Migrate to ISE 3.4 Patch 4+ or ISE 3.5."
    exit 1
    ;;
esac