CVE-2026-20283

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.  This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit this vulnerability by sending crafted input to the IPsec Open API endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system.  To exploit this vulnerability, the attacker must have valid administrative credentials and the node must have more than one network interface, one of which must be configured as an active IPsec tunnel. Note: For CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc

Configurations

No configuration.

History

16 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 21:17

Updated : 2026-09-18 13:28

NVD link : CVE-2026-20283

Mitre link : CVE-2026-20283

CVE.ORG link : CVE-2026-20283

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-20283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-17T03:57:40.682633Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.3 Patch 2"}, {"status": "affected", "version": "3.3 Patch 1"}, {"status": "affected", "version": "3.3 Patch 3"}, {"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.3 Patch 4"}, {"status": "affected", "version": "3.4 Patch 1"}, {"status": "affected", "version": "3.3 Patch 5"}, {"status": "affected", "version": "3.3 Patch 6"}, {"status": "affected", "version": "3.4 Patch 2"}, {"status": "affected", "version": "3.3 Patch 7"}, {"status": "affected", "version": "3.4 Patch 3"}, {"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.4 Patch 4"}, {"status": "affected", "version": "3.3 Patch 8"}, {"status": "affected", "version": "3.5 Patch 1"}, {"status": "affected", "version": "3.3 Patch 9"}, {"status": "affected", "version": "3.4 Patch 5"}, {"status": "affected", "version": "3.5 Patch 3"}, {"status": "affected", "version": "3.5 Patch 2"}, {"status": "affected", "version": "3.3 Patch 10"}, {"status": "affected", "version": "3.3 Patch 11"}, {"status": "affected", "version": "3.4 Patch 6"}], "defaultStatus": "unknown"}]}], "published": "2026-09-16T21:17:08.970", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. \r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit this vulnerability by sending crafted input to the IPsec Open API endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system. \r\nTo exploit this vulnerability, the attacker must have valid administrative credentials and the node must have more than one network interface, one of which must be configured as an active IPsec tunnel.\r\nNote: For CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level."}], "lastModified": "2026-09-18T13:28:28.567", "sourceIdentifier": "psirt@cisco.com"}