Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability

CVE-2026-20180 is an authenticated remote code execution flaw in Cisco Identity Services Engine (ISE) caused by insufficient validation of user-supplied input in the web management interface. Cisco says an attacker with at least Read Only Admin credentials can send a crafted HTTP request, gain user-level access on the underlying OS, and then escalate to root. Cisco's fixed-version guidance says affected trains are earlier than 3.2, 3.2 before Patch 8, 3.3 before Patch 8, and 3.4 before Patch 4; 3.5 is not vulnerable. In single-node deployments, exploitation can also knock the node unavailable and block new endpoint authentications.

Cisco's 9.9 CRITICAL label is technically defensible on impact, but it overstates the *reachability* for enterprise prioritization. This is not unauthenticated internet RCE: the attacker needs management-plane reachability plus valid admin credentials, and Cisco specifically says Read Only Admin is enough. That makes this a dangerous post-compromise / credential-abuse amplifier against a high-value appliance, not a universal emergency on the same level as pre-auth edge-device RCE.

Why this verdict

• Downgrade from 9.9 because PR:L is misleading in practice: this is not 'any low-priv user'; it is Read Only Admin on ISE, which already implies privileged access to a security appliance.
• Further downgrade because the attacker needs management-plane reachability: most enterprises do not intentionally expose ISE admin UI to the internet, so reachable population is far smaller than commodity edge-RCE bugs.
• Kept in HIGH because blast radius is meaningful once landed: root on ISE means compromise of a central identity and network-access enforcement point, and Cisco warns single-node deployments can also suffer auth-disrupting DoS.
• No upgrade pressure from threat intel: no KEV listing, low prompt-supplied EPSS, and no authoritative evidence of active exploitation found during review.
• No bigger downgrade because compensating stack is imperfect on appliances: EDR is often absent, logging can be thinner than on Windows/Linux servers, and admin credential theft remains a realistic path.

Why not higher?

This is not pre-auth, not broadly wormable, and not something a random internet scanner can usually turn into instant root without prior progress. Requiring both admin-plane access and Read Only Admin credentials makes it a compound chain, and each prerequisite knocks down the real-world attack volume.

Why not lower?

Once the prerequisites are met, exploitation is low-complexity and the payoff is root on the NAC brain. Even though this is a narrower population than classic edge RCE, the operational blast radius is still serious enough that calling it MEDIUM would understate the risk to enterprises that actually run Cisco ISE.

1. Lock admin access to jump hosts — Restrict ISE web management reachability to dedicated admin subnets, bastions, or VPN source ranges only. This is the cleanest exposure reduction while you schedule patching, and for a HIGH verdict it should be in place within 30 days if not already standard.
2. Enforce MFA on every ISE admin path — This bug starts with valid admin credentials, so make credential theft harder to convert into appliance compromise. If SSO or VPN gates ISE administration, require phishing-resistant MFA where possible and close gaps within 30 days.
3. Cull read-only admin accounts — Treat Read Only Admin as code-exec-capable for this advisory, not as a harmless audit role. Remove stale accounts, rotate secrets for service-linked admins, and shrink group membership within 30 days.
4. Deploy Cisco detection content — Enable and monitor the Cisco-published Snort rules 66300-66306 and alert on unusual admin HTTP requests to ISE. Detection is not remediation, but it gives you a chance to catch exploit attempts during the 30-day mitigation window.
5. Prioritize single-node deployments — Cisco explicitly notes single-node ISE deployments can become unavailable and block new endpoint authentications after exploitation. Identify those appliances first because their business impact is worse even though the exploit preconditions are the same.

Run this from an auditor workstation or jump host that can SSH to the Cisco ISE CLI, not from a random endpoint. Invoke it as ./check_cve_2026_20180.sh [email protected]; it needs only enough CLI privilege to run show version, not root shell access.

#!/usr/bin/env bash
# check_cve_2026_20180.sh
# Determine likely exposure to CVE-2026-20180 on a Cisco ISE node via SSH CLI.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/CONNECT ERROR

set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <user@host>" >&2
  exit 3
fi

SSH_OPTS=(
  -o BatchMode=yes
  -o ConnectTimeout=10
  -o StrictHostKeyChecking=accept-new
)

get_version_output() {
  ssh "${SSH_OPTS[@]}" "$TARGET" "show version" 2>/dev/null
}

OUT="$(get_version_output)"
if [[ -z "$OUT" ]]; then
  echo "UNKNOWN - unable to retrieve 'show version' from $TARGET"
  exit 2
fi

# Normalize whitespace for easier regex handling.
NORM="$(printf '%s\n' "$OUT" | tr -s '[:space:]' ' ')"

# Try to find a major.minor release like 3.1 / 3.2 / 3.3 / 3.4 / 3.5
REL=""
PATCH="0"

if [[ "$NORM" =~ ([0-9]+\.[0-9]+) ]]; then
  REL="${BASH_REMATCH[1]}"
fi

if [[ "$NORM" =~ [Pp]atch[[:space:]]*([0-9]+) ]]; then
  PATCH="${BASH_REMATCH[1]}"
fi

if [[ -z "$REL" ]]; then
  echo "UNKNOWN - could not parse version from output"
  printf '%s\n' "$OUT"
  exit 2
fi

status="UNKNOWN"
reason="unhandled version logic"

case "$REL" in
  3.5)
    status="PATCHED"
    reason="Cisco advisory states 3.5 is not vulnerable"
    ;;
  3.4)
    if (( PATCH >= 4 )); then
      status="PATCHED"
      reason="3.4 Patch 4 or later is fixed"
    else
      status="VULNERABLE"
      reason="3.4 before Patch 4 is vulnerable"
    fi
    ;;
  3.3)
    if (( PATCH >= 8 )); then
      status="PATCHED"
      reason="3.3 Patch 8 or later is fixed"
    else
      status="VULNERABLE"
      reason="3.3 before Patch 8 is vulnerable"
    fi
    ;;
  3.2)
    if (( PATCH >= 8 )); then
      status="PATCHED"
      reason="3.2 Patch 8 or later is fixed"
    else
      status="VULNERABLE"
      reason="3.2 before Patch 8 is vulnerable"
    fi
    ;;
  3.1)
    status="VULNERABLE"
    reason="Earlier than 3.2 must migrate to a fixed release"
    ;;
  *)
    # Earlier than 3.2 or any unexpected branch
    if [[ "$REL" =~ ^([0-2])\. ]]; then
      status="VULNERABLE"
      reason="Earlier than 3.2 must migrate to a fixed release"
    else
      status="UNKNOWN"
      reason="Version outside scripted Cisco guidance"
    fi
    ;;
esac

echo "$status - $TARGET reports release $REL patch $PATCH ($reason)"

case "$status" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. Cisco advisory: Cisco Identity Services Engine Remote Code Execution Vulnerabilities
2. OpenCVE enrichment for CVE-2026-20180
3. CISA Known Exploited Vulnerabilities Catalog
4. Bitsight Groma Explorer: Cisco Identity Services Engine Observation Footprint
5. SecurityWeek coverage of Cisco April 2026 patches
6. CIRCL Vulnerability Lookup for CVE-2026-20180
7. ZeroPath summary of CVE-2026-20180