CVE-2026-20186

CVE-2026-20186 is a critical command execution vulnerability affecting Cisco Identity Services Engine (ISE) that stems from insufficient input validation. An authenticated attacker with Read Only Admin credentials can send a specially crafted HTTP request to execute arbitrary commands on the underlying operating system with user-level privileges and potential root elevation. The vulnerability carries a CVSS score of 9.9 (Critical) with a network-based attack vector requiring minimal complexity and only low-privilege credentials. The attack requires no user interaction and has significant scope impact, enabling complete compromise of confidentiality, integrity, and availability. In single-node deployments, successful exploitation could trigger a denial of service condition, preventing unauthenticated endpoints from accessing the network until the affected node is restored. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on exploit tracking lists. The EPSS score of 0.0028 indicates this threat ranks lower than most CVEs in terms of real-world exploitation probability, though the critical severity rating and relatively low barrier to entry for authenticated attackers warrants prompt patching.