Critical Command Execution Vulnerability Patched in Cisco ISE

A critical vulnerability (CVE-2026-20181, CVSS 9.1) in Cisco Identity Services Engine allows authenticated attackers to escalate privileges to root by sending a specially crafted HTTP request — effectively handing over full OS control. Because ISE is a core network access control and identity management platform, a compromise could allow attackers to manipulate authentication policies, grant unauthorized network access, or pivot laterally across the entire enterprise. The severity is amplified by the fact that ISE-PIC, used for passive identity tracking, is also affected, broadening the attack surface. This incident underscores the danger of unpatched critical infrastructure components, particularly those that serve as gatekeepers to network access.