CVE-2026-20283

Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

No known exploitation. EPSS puts it in the 51st percentile. No fix published yet.

CVSS 3.16.5Medium EPSS percentile51st0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157976

Run the check

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Cisco Identity Services Engine SoftwareAffected: 3.3.0Upgrade to: not statedAffected: 3.3 Patch 2Upgrade to: not statedAffected: 3.3 Patch 1Upgrade to: not statedAffected: 3.3 Patch 3Upgrade to: not stated + 19 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Cisco Identity Services Engine Software with more than one network connection and an active IPsec tunnel.
Identify and review all administrator accounts; remove unused accounts, require strong sign-in protection, and restrict administrator access to trusted networks.
Cisco has not published fixed-version information yet; ask Cisco or your support provider for the affected releases and the first fixed version.
Until a fix is available, disable or restrict access to the IPsec Open API where business operations allow it.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.  This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit this vulnerability by sending crafted input to the IPsec Open API endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system.  To exploit this vulnerability, the attacker must have valid administrative credentials and the node must have more than one network interface, one of which must be configured as an active IPsec tunnel. Note: For CVE-2026-20283, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.

In plain language

Written by AI from the record

This is a serious flaw in Cisco Identity Services Engine Software that could let someone with an administrator account take control of the system; act now because a public exploit is available.

Authenticated remote command injection (CWE-78) in the Cisco Identity Services Engine Software IPsec Open API can enable arbitrary OS command execution, with a straightforward path to root privileges.

If you're affected

Identity system takeover
Network access disruption
Credential theft risk
Security policy changes
Operational disruption

What is it

A weakness in this identity-management system can allow an attacker who already has an administrator account to make the underlying server run their commands. It is like giving someone with a master key the ability to replace the building’s locks, read restricted files, and change the security rules.

Who is affected

This matters to you if you run Cisco Identity Services Engine Software. The risk applies when a node has more than one network interface and at least one active IPsec tunnel; the attacker must already have valid administrator credentials.

How urgent is it

A public exploit is available, meaning attackers who obtain or misuse an administrator account have a practical route to take over the affected system. Treat this as urgent: restrict administrator access and the exposed feature now while you obtain Cisco’s fix guidance.

What to do — in detail

Confirm whether each Cisco Identity Services Engine Software node has multiple network interfaces and an active IPsec tunnel, then determine whether the IPsec Open API is reachable by accounts or networks beyond tightly controlled administrators. Review administrator-account creation, sign-in activity, and configuration changes for unexpected activity, and remove or disable unused privileged accounts.

No fixed versions or patch information are available in the findings. Contact Cisco support or your Cisco partner for the affected-release list, the first fixed release for your upgrade branch, and any required upgrade path or compatibility notes before scheduling the update.

If patching is delayed, restrict or disable IPsec Open API access where feasible, limit administrative access to approved management networks, and require strong authentication for all administrator accounts. Monitor for unusual administrator logins, unexpected IPsec configuration changes, and unexplained command or system-level activity. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so no CISA remediation due date is provided.

Technical context

CVE-2026-20283 is rated CVSS 6.5 (Medium): AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The weakness is CWE-78 command injection caused by insufficient validation of user-supplied input in IPsec Open API calls. An authenticated remote attacker with valid administrative credentials can submit crafted input and execute arbitrary commands on the underlying OS; exploitation additionally requires more than one network interface and an active IPsec tunnel. Cisco assigned a High Security Impact Rating because root escalation from the achieved privilege level is considered easy. A public exploit is available. The CVE is not in CISA KEV. EPSS is 0.4% (37th percentile) and flat; this is a predicted likelihood, not confirmation of in-the-wild exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS51st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 51st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-18Record updated
2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Identity Services Engine SoftwareNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact