CVE-2026-20136

OVERVIEW CVE-2026-20136 is a command injection vulnerability affecting the CLI interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw stems from insufficient validation of user-supplied input in specific CLI commands, allowing authenticated local attackers with administrative privileges to inject arbitrary commands into the underlying operating system. SEVERITY This vulnerability carries a CVSS score of 6.0 (Medium) with a local attack vector, low complexity, and high administrative privileges required. The impact is significant as successful exploitation enables privilege escalation to root access with high confidentiality and integrity consequences, though availability is not affected. The relatively low CVSS rating reflects the prerequisite requirement for authenticated local administrative access, which limits the practical attack surface. EXPLOITATION STATUS There is currently no evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score of 0.00055 indicates minimal likelihood of exploitation compared to other CVEs. The Inactive Hot List status and low community attention suggest this is not a priority target for threat actors at this time, though organizations should still prioritize patching to prevent potential privilege escalation by malicious insiders with administrative access.