CVE-2026-20130

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

Scoring

Severity

CRITICAL

CVSS base score

10

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-74

Published

2026-09-16

Last modified

2026-09-16

Affected products

• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software
• Cisco Cisco Identity Services Engine Software

Weakness type

• CWE-74

Related vulnerabilities

• CVE-2026-87572 — Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer
• CVE-2026-82971 — QVidium Opera11 CGI Script net_tr.cgi command injection
• CVE-2026-12351 — IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
• CVE-2026-79697 — Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
• CVE-2026-79698 — Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
• CVE-2026-79234 — Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive infor
• CVE-2026-83772 — Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection
• CVE-2026-83524 — RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

Markdown version · Browse all CVEs