Cisco has introduced patches to handle 4 essential security flaws impacting Id Companies and Webex Companies that might end in arbitrary code execution and permit an attacker to impersonate any consumer throughout the service.
The main points of the vulnerabilities are beneath –
- CVE-2026-20184 (CVSS rating: 9.8) – An improper certificates validation within the integration of single sign-on (SSO) with Management Hub in Webex Companies that might enable an unauthenticated, distant attacker to impersonate any consumer throughout the service and acquire unauthorized entry to reputable Cisco Webex providers.
- CVE-2026-20147 (CVSS rating: 9.9) – An inadequate validation of user-supplied enter vulnerability in Id Companies Engine (ISE) and ISE Passive Id Connector (ISE-PIC) that might enable an authenticated, distant attacker in possession of legitimate administrative credentials to realize distant code execution by sending crafted HTTP requests.
- CVE-2026-20180 and CVE-2026-20186 (CVSS scores: 9.9) – A number of inadequate validation of user-supplied enter vulnerabilities in ISE may enable an authenticated, distant attacker in possession of learn solely admin credentials to execute arbitrary instructions on the underlying working system of an affected system by sending crafted HTTP requests.
“A profitable exploit may enable the attacker to acquire user-level entry to the underlying working system after which elevate privileges to root,” Cisco mentioned in an advisory for CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186.
“In single-node ISE deployments, profitable exploitation of this vulnerability may trigger the affected ISE node to develop into unavailable, leading to a denial of service (DoS) situation. In that situation, endpoints that haven’t already authenticated can be unable to entry the community till the node is restored.”
CVE-2026-20184 requires no buyer motion because it’s cloud-based. Nonetheless, prospects who’re utilizing SSO are suggested to add a brand new id supplier (IdP) SAML certificates to Management Hub. The remaining vulnerabilities have been addressed within the following variations –
- CVE-2026-20147
- Cisco ISE or ISE-PIC Launch sooner than 3.1 (Migrate to a set launch)
- Cisco ISE Launch 3.1 (3.1 Patch 11)
- Cisco ISE Launch 3.2 (3.2 Patch 10)
- Cisco ISE Launch 3.3 (3.3 Patch 11)
- Cisco ISE Launch 3.4 (3.4 Patch 6)
- Cisco ISE Launch 3.5 (3.5 Patch 3)
- CVE-2026-20180 and CVE-2026-20186
- Cisco ISE Launch sooner than 3.2 (Migrate to a set launch)
- Cisco ISE Launch 3.2 (3.2 Patch 8)
- Cisco ISE Launch 3.3 (3.3 Patch 8)
- Cisco ISE Launch 3.4 (3.4 Patch 4)
- Cisco ISE Launch 3.5 (Not Susceptible)
Whereas Cisco famous that it isn’t conscious of any of those shortcomings being exploited within the wild, it is important that customers replace their situations to the newest model for optimum safety.
