CVE-2026-20180

CVE-2026-20180 is a critical remote code execution vulnerability in Cisco Identity Services Engine (ISE) that allows authenticated attackers with Read Only Admin credentials or higher to execute arbitrary operating system commands through insufficient input validation in HTTP requests. The vulnerability enables attackers to gain user-level access to the underlying OS and escalate privileges to root, with potential impacts including complete system compromise and denial of service in single-node deployments that could disconnect unauthenticated endpoints from the network. The vulnerability carries a CVSS 3.1 score of 9.9 (Critical) with a network-based attack vector, low attack complexity, and low privilege requirements, resulting in high confidentiality, integrity, and availability impacts across system boundaries. Exploitation requires only crafted HTTP requests and an attacker with minimal authentication credentials, making it relatively straightforward to exploit from a technical standpoint. This vulnerability is not currently listed on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog and shows no indicators of active exploitation in the wild. The EPSS score of 0.0026 indicates this CVE is in the lower percentile for real-world exploitation probability, and the vulnerability remains on inactive status from a community attention standpoint. However, the critical CVSS rating and authentication-only barrier to exploitation warrant prompt patching to mitigate potential future exploitation risk.