Vulnerability threat dossier
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain system-level access to the underlying operating system and then elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
VTP analyst assessment
CVE-2026-20176 is a command-injection flaw in Cisco Identity Services Engine. A remote attacker needs valid high-privileged administrative credentials to execute arbitrary commands on the underlying operating system.
1 record references and 3 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
A BleepingComputer assertion reports exploitation, but its supplied excerpt identifies CVE-2026-76460 rather than CVE-2026-20176.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use affected Cisco ISE, apply Cisco's security update and rotate or review high-privileged administrator credentials.
VTP deterministic assessment
EPSS is 0.01; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
2 primary sources · 0 dependent secondary reports · 2 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.
CERT-FR published evidence linked to CVE-2026-20176.
Cisco Product Security Incident Response Team published evidence linked to CVE-2026-20176.
Cisco Product Security Incident Response Team published evidence linked to CVE-2026-20176.
Original publications
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance. Cisco indique que la vulnérabilité CVE-2026-76460 est...
On September 16, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery . Cisco Identity Services Engine Title CVE ID SIR Base Score Cisco Identity Services Engine Hardening Release: September 2026 CVE-2026-20130 CVE-2026-20192 CVE-2026-20194 CVE-2026-20234 CVE-2026-20237 CVE-2026-20287 Critical 10.0 Cisco Identity Services Engine Vulnerabilities CVE-2026-76423 CVE-2026-76425 CVE-2026-76426 CVE-2026-76427 CVE-2026-76428 CVE-2026-76424 Critical 10.0 Cisco Identity Services Engine Authentication Bypass Vulnerability CVE-2026-76460 Critical 10.0 Cisco Identity Services Engine Remote Code Execution Vulnerabilities CVE-2026-20211 CVE-2026-20176 CVE-2026-20307 Critical 9.9 Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities CVE-2026-20282 CVE-2026-20283 CVE-2026-20284 Critical 9.1 Cisco Identity Services Engine Command Injection Vulnerabilities CVE-2026-20306 CVE-2026-20305 Critical 9.1 Cisco Identity Services Engine RADIUS Denial of Service Vulnerability CVE-2026-20352 High 8.6 Cisco Identity Services Engine SQL Injection Vulnerabilities CVE-2026-20247 CVE-2026-20300 High 7.5 Cisco Identity Services Engine Cross-Site Scripting Vulnerability</ <br/>Security Impact Rating: Informational
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit these vulnerabilities, the attacker must have valid administrative credentials. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57 This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 . <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-20176,CVE-2026-20211,CVE-2026-20307
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.