CVE-2026-20307: Cisco ISE Remote Code Execution Vulnerability
A low-privileged ISE administrator can submit a crafted serialized Java object and elevate to root. Apply this CVE's patch and assess earlier access separately; the higher privilege requirement of other ISE flaws does not apply.
CVE-2026-20306: Cisco ISE Command Injection Vulnerability
Administrators can inject commands through the ISE or ISE-PIC REST API and elevate to root. Preserve API and account evidence, then apply the product-specific patch; this is separate from the companion diagnostic-tool flaw.
CVE-2026-20305: Cisco ISE Command Injection Vulnerability
Administrative diagnostic-tool access can lead to command execution and root privileges in ISE and ISE-PIC. Match each product to its fix and account for the network-admission impact of losing a single ISE node.
CVE-2026-20300: Cisco ISE SQL Injection Vulnerability
Even a low-privileged ISE administrator can exploit SQL injection to read or modify database records. Apply the CVE-specific patch and assess data exposure and changes; operating-system command execution is not established by this notice.
CVE-2026-20295: Cisco Secure FMC Software and Secure FTD Software sftunnel Memory Exhaustion DoS Vulnerability
Crafted frames during sftunnel TLS setup can exhaust memory on vulnerable FMC and FTD devices. Inventory both ends of the management connection, preserve resource-pressure evidence, and install each platform's CVE-specific fixed release.
CVE-2026-20290: Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
Crafted SSL setup requests can restart the Snort 2 detection engine. Check standalone Snort and the engine actually running on FTD, then follow their respective update paths; a full firewall reload is not established here.
CVE-2026-20287: Cisco ISE hardening: Improper Privilege Management Vulnerabilities
Cisco's ISE privilege-management hardening entry does not identify a specific affected operation. Check migration guidance carefully: legacy patches limited to Critical fixes do not establish coverage for this category merely because the umbrella advisory is Critical.
CVE-2026-20286: Cisco ISE Authorization Bypass vulnerability
An ISE Administrator can bypass permission checks to modify file descriptions on management pages. Apply the ISE patch or supported migration; ISE-PIC is excluded from this CVE despite appearing in the shared advisory.
CVE-2026-20285: Cisco ISE Authorization Bypass vulnerability
An authenticated Administrator can change file descriptions without required permission checks in ISE or ISE-PIC. Apply the product-specific fix, retaining ISE-PIC's support boundary; this is not established file-content access or root control.
CVE-2026-20284: Cisco ISE SXP REST API SQL Injection Vulnerability
An ISE administrator can read or change database contents through the SXP REST API when SXP and a connection are configured. Apply the specific patch and check new endpoint authentication after maintenance.