A critical-severity SQL injection flaw in the SXP REST API of Cisco Identity Services Engine lets an authenticated remote attacker read or modify the underlying database, and can knock a single-node ISE deployment offline entirely.
What Is It
Cisco ISE fails to sufficiently validate user-supplied input in SXP REST API calls, allowing an authenticated remote attacker to inject SQL (CWE-943, improper neutralization of special elements in data query logic). By sending crafted input to an affected device, an attacker can view or modify data in the device's backing database.
Cisco scores it CVSS 3.1 9.1 CRITICAL (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The high privileges-required rating reflects real preconditions: the attacker must hold valid administrative credentials, the SXP service must be enabled, and at least one SXP connection must be configured. The changed scope and full CIA impact are what drive the score into critical territory despite that bar.
Why It Matters
ISE is a network access control chokepoint, and its database holds the policy and identity data that decides who gets on the network. Read/write access to that database is a direct path to tampering with access decisions.
The availability angle is sharper still. In single-node deployments, successful exploitation can render the ISE node unavailable; a denial-of-service condition in which endpoints that have not already authenticated cannot access the network until the node is restored. A single crafted request can therefore turn into a site-wide network access outage.
What's Vulnerable
Cisco Identity Services Engine Software, across a broad version span. Cisco lists the 3.1.0 line (including patches p1 through p11), 3.2.0 (through Patch 10), 3.3 (through Patch 11), 3.4 (through Patch 6), and 3.5 (through Patch 3) as affected. In practice, assume any currently deployed 3.1–3.5 ISE build is in scope until checked against the Cisco advisory.
Exposure is conditional: if the SXP service is disabled or no SXP connection is configured, the vulnerability cannot be exploited.
Patch Status
The CVE was published 2026-09-16 and its NVD record is still in "Received" status, so no NVD-analyzed CPE data or independent remediation guidance exists yet. Fixed-release information is carried in Cisco's bundled ISE advisory (cisco-sa-ise-mult-vul-ymSsTLCc), consult it for the fixed build matching your train.
As of 2026-09-16, CVE-2026-20284 is not listed in CISA's Known Exploited Vulnerabilities catalog: there is no confirmation of active exploitation and no KEV-mandated remediation deadline. Because the catalog is updated continuously, check it directly before treating that status as current.
Sources
- Cisco Security Advisory; cisco-sa-ise-mult-vul-ymSsTLCc: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc
- NVD, CVE-2026-20284: https://nvd.nist.gov/vuln/detail/CVE-2026-20284
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog