A critical insecure-deserialization bug in the Cisco Identity Services Engine web management interface lets an authenticated remote attacker with low-privileged admin credentials run arbitrary commands as root.
What Is It
CVE-2026-20307 is an insecure deserialization vulnerability (CWE-502) in the web-based management interface of Cisco Identity Services Engine (ISE). The interface accepts a user-supplied Java byte stream without safe handling, so an attacker who sends a crafted serialized Java object can execute arbitrary commands on the underlying operating system. Exploitation requires at least low-privileged administrative credentials, but no user interaction. Cisco PSIRT rates it 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Why It Matters
This is a privilege-escalation path straight to root on a device that is itself the network's access-control authority. A successful exploit gives the attacker arbitrary code execution and root on the ISE node; full confidentiality, integrity, and availability impact, with a changed CVSS scope reflecting that the blast radius extends past the vulnerable component.
There is a second failure mode. In single-node deployments, exploitation can knock the ISE node offline entirely, producing a denial-of-service condition. While the node is down, endpoints that have not already authenticated cannot get onto the network. The CVSS vector's PR:L rating indicates that low-privileged administrative credentials are sufficient for either outcome; the advisory does not enumerate which specific admin roles qualify, so whether commonly issued read-only or junior accounts meet that bar is not established in the published data.
What's Vulnerable
Cisco Identity Services Engine Software across the 3.1, 3.2, 3.3, 3.4, and 3.5 branches. Cisco lists 3.2.0 through 3.2 Patch 10, 3.3.0 through 3.3 Patch 11, 3.4.0 through 3.4 Patch 6, and 3.5.0 through 3.5 Patch 3 as affected. The 3.1 train is also listed as affected, but the published patch-level enumeration for that branch is inconsistent in the source data, so confirm 3.1 coverage directly against the Cisco advisory. Every currently enumerated patch level in these trains is marked affected in the published data.
Patch Status
The CVE was published 2026-09-16 and its NVD record is still "Awaiting Analysis." No CISA KEV entry accompanies this record, so there is no confirmed active exploitation and no KEV remediation deadline at this time. The supplied data contains no fixed-version list; consult the Cisco security advisory below for fixed releases and any workarounds.
Sources
- Cisco Security Advisory (cisco-sa-ise-rce-se7bYU57), https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57
- NVD, CVE-2026-20307, https://nvd.nist.gov/vuln/detail/CVE-2026-20307