Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Cisco has addressed multiple critical vulnerabilities in its Identity Services Engine (ISE) that could allow authenticated attackers to modify device configurations without proper authorization.
The vulnerabilities, identified as CVE-2026-20286, CVE-2026-20183, and CVE-2026-20285, exist in the web-based management interface of Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. These flaws stem from insufficient server-side validation of administrator permissions, potentially enabling attackers to modify file descriptions on specific pages.
Exploitation requires valid administrator credentials, with attackers submitting specially crafted HTTP requests to affected systems. While Cisco has confirmed no public exploits or malicious use are currently known, the vulnerabilities pose significant risks to organizational security if left unpatched.
Affected Products
At the time of publication, CVE-2026-20286 and CVE-2026-20183 affected all versions of Cisco ISE regardless of device configuration. Meanwhile, CVE-2026-20285 impacted both Cisco ISE and Cisco ISE-PIC systems. Notably, Cisco has confirmed that the first two vulnerabilities do not affect ISE-PIC devices.
Software Updates
Cisco has released software updates to address these vulnerabilities, with different fixed releases depending on the version. For ISE versions 3.2 and earlier, customers must migrate to a fixed release. Version 3.3 requires patch 12, while version 3.4 needs patch 7.
The company emphasizes that no workarounds exist for these vulnerabilities, making software upgrades the only viable solution. Cisco strongly recommends customers upgrade to the indicated fixed releases to prevent potential exploitation.
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available.
Response and Next Steps
The Cisco PSIRT is not aware of any public announcements or malicious use of these vulnerabilities. Adrian Michalczyk is credited with reporting these issues to Cisco. The company has provided detailed upgrade guides on its Identity Service Engine support page.
Customers without service contracts or who purchased through third-party vendors should contact Cisco Technical Assistance Center for upgrades, providing their product serial number and the advisory URL. Organizations should verify their devices have sufficient memory and confirm compatibility before upgrading.
Related
