CVE-2026-20284
Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability
Description
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
In plain language
AI Act nowA critical flaw in Cisco Identity Services Engine Software can let a logged-in administrator alter its database through a public exploit, so affected businesses should act now even though Cisco has not published a fix.
Authenticated SQL injection in the Cisco Identity Services Engine Software SXP REST API (CWE-943) allows crafted API input to read or modify the underlying database and can cause a single-node deployment to become unavailable.
What to do now
- Check whether you run Cisco Identity Services Engine Software and whether SXP is enabled with an SXP connection configured.
- Identify all administrator accounts that can access the SXP REST API; remove unnecessary access and reset credentials you do not recognize.
- Cisco has not published a fixed version yet; ask Cisco or your support provider for the vendor-approved update as soon as it is available.
- Until then, disable SXP if your network does not need it, or restrict SXP REST API access to only the required administrators and management network.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:HPrivileges RequiredUI:NUser InteractionS:CScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.
View exploit detailsReferences
- Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboarden-us·SecurityWeek· Exploited Cisco Secure Firewall Management Center rce
- Cisco warns of max severity ISE zero-day exploited in attacksen-us·BleepingComputer· Exploited Identity Services Engine (ISE) zero-day
- Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacksen·The Hacker News· Exploited Identity Services Engine (ISE) zero-day
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-20284 and every CVE in our database. Create a free account — no credit card required.
Create Free Account