Cisco ISE CVE-2026-20282/20283/20284 SQL Injection and Command Injection Advisory with Patch Versions

Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities: Key Information Summary Vulnerability Overview Severity: Critical CVE IDs: CVE-2026-20282, CVE-2026-20283, CVE-2026-20284 Vulnerability Types: - CVE-2026-20284: SQL injection vulnerability in the SXP REST API of ISE. An authenticated remote attacker can craft a SQL injection payload to modify data on the underlying operating system of the affected system. - CVE-2026-20283: Command injection vulnerability in the Ipsec Open API of ISE. An authenticated remote attacker can inject arbitrary commands into the underlying operating system. - CVE-2026-20282: Authenticated write vulnerability in ISE. An authenticated remote attacker can obtain write privileges on the underlying operating system. Impact: In single-node deployments, successful exploitation may cause the ISE node to enter a Denial of Service (DoS) state, where unauthenticated endpoints cannot access the network until the node is restarted. Exploitation Conditions: - For CVE-2026-20284: The attacker must have valid administrative credentials, and the SXP service must be enabled with at least one SXP connection configured. - For CVE-2026-20283: The node must be configured with multiple network interfaces, with at least one configured as an active Ipsec tunnel. Affected Scope Affected Product: Cisco Identity Services Engine (ISE) Confirmed Unaffected Product: Cisco ISE Passive Identity Connector (ISE-PIC) Configuration Assessment: - SXP service enabled with SXP connections configured → Vulnerable configuration - Ipsec tunnel configured with an IP address or FQDN → Vulnerable configuration - Ipsec tunnel configured only with an IP address or FQDN → Non-vulnerable configuration Remediation Fixed Versions: Interim Mitigations (Workarounds): - CVE-2026-20282 and CVE-2026-20284: No available interim mitigations. - CVE-2026-20283: The vulnerable configuration (Ipsec tunnel) can be removed via the Web interface: 1. Navigate to Administration > System > Settings > Protocols > Ipsec > Native Ipsec. 2. Select the tunnel with the vulnerable configuration and delete it. 3. Reconfigure the tunnel via the Web interface. Recommendation: It is strongly recommended that customers upgrade to the fixed software versions, assessing applicability prior to deployment. POC/Exploit Code No POC code or exploit code blocks are included in the source document.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco ISE CVE-2026-20282/20283/20284 SQL Injection and Command Injection Advisory with Patch Versions