Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

criticalCVE-2026-20181 CVE-2026-20190

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv Security Impact Rating: Critical CVE: CVE-2026-20181,CVE-2026-20190

CSIRTS triage

vendor: Cisco product: Identity Services Engine Remote code execution Information disclosure

What: Multiple vulnerabilities could allow remote code execution or information disclosure.
Who is affected: Deployments of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
Urgency: Remediation is critical as the vulnerabilities are severe, although not currently exploited.
Action: Update to the latest software versions provided by Cisco.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Identity Services Engine

Get an email when a new Identity Services Engine advisory drops — max one per day, one-click unsubscribe.

Details

Source: Cisco Security Advisories (INTL · vendor-psirt · site)
Severity: critical
Published: 2026-07-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20and%20Information%20Disclosure%20Vulnerabilities%26vs_k=1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-201810.75% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-201900.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20181	coverage & exploitation status	NVD · CVE.org
CVE-2026-20190	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownNCSC-2026-0208 [1.00] [M/H] Vulnerabilities fixed in Cisco Identity Services Enginencsc-nl

Recent advisories for Cisco Identity Services

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0208 [1.00] [M/H] Vulnerabilities fixed in Cisco Identity Services Enginencsc-nl · 2026-06-19
mediumCisco Identity Services Engine Authentication Bypass Vulnerabilitiescisco-psirt · 2026-05-06
mediumCisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilitiescisco-psirt · 2026-05-05
criticalCisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilitiescisco-psirt · 2026-04-28
criticalCisco Identity Services Engine Remote Code Execution Vulnerabilitiescisco-psirt · 2026-04-15
mediumCisco Identity Services Engine Authenticated Privilege Escalation Vulnerabilitycisco-psirt · 2026-04-15