Vulnerability threat dossier
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
VTP analyst assessment
CVE-2026-20284 affects Cisco Identity Services Engine's SXP REST API. An authenticated remote attacker can submit crafted API input to exploit insufficient validation and view or modify data. Public reporting records an exploitation claim, but the mapped assertion has unknown source independence. Prioritize remediation where authenticated users can reach this API.
1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The exploitation report is not independently corroborated in the mapped assertion.
The available sources also discuss CVE-2026-76460 and broader Cisco issues; they do not establish exploitation of CVE-2026-20284.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use Cisco ISE, identify instances exposing the SXP REST API to authenticated users and apply Cisco's remediation for CVE-2026-20284.
VTP deterministic assessment
EPSS is 0.00; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
2 primary sources · 0 dependent secondary reports · 3 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.
CERT-FR published evidence linked to CVE-2026-20284.
Cisco Product Security Incident Response Team published evidence linked to CVE-2026-20284.
Cisco Product Security Incident Response Team published evidence linked to CVE-2026-20284.
Original publications
The vulnerabilities may lead to root access, command execution, bypasses, SQL injection, and remote code execution. The post Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard appeared first on SecurityWeek .
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance. Cisco indique que la vulnérabilité CVE-2026-76460 est...
On September 16, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery . Cisco Identity Services Engine Title CVE ID SIR Base Score Cisco Identity Services Engine Hardening Release: September 2026 CVE-2026-20130 CVE-2026-20192 CVE-2026-20194 CVE-2026-20234 CVE-2026-20237 CVE-2026-20287 Critical 10.0 Cisco Identity Services Engine Vulnerabilities CVE-2026-76423 CVE-2026-76425 CVE-2026-76426 CVE-2026-76427 CVE-2026-76428 CVE-2026-76424 Critical 10.0 Cisco Identity Services Engine Authentication Bypass Vulnerability CVE-2026-76460 Critical 10.0 Cisco Identity Services Engine Remote Code Execution Vulnerabilities CVE-2026-20211 CVE-2026-20176 CVE-2026-20307 Critical 9.9 Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities CVE-2026-20282 CVE-2026-20283 CVE-2026-20284 Critical 9.1 Cisco Identity Services Engine Command Injection Vulnerabilities CVE-2026-20306 CVE-2026-20305 Critical 9.1 Cisco Identity Services Engine RADIUS Denial of Service Vulnerability CVE-2026-20352 High 8.6 Cisco Identity Services Engine SQL Injection Vulnerabilities CVE-2026-20247 CVE-2026-20300 High 7.5 Cisco Identity Services Engine Cross-Site Scripting Vulnerability</ <br/>Security Impact Rating: Informational
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct SQL injections, modify data, or execute arbitrary commands on the underlying operating system on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Note: For CVE-2026-20282 and CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the scores indicate. The reason is that it is easy to get to root from the achieved privilege level. Cisco has released software updates that address these vulnerabilities. There are workarounds that address one of these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Cisco Identity Services Engine, see Cisco Identity Services Engine Security Hardening Release: September 2026 . <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-20282,CVE-2026-20283,CVE-2026-20284
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.