CVE-2026-20283: Cisco ISE IPsec Open API Command Injection Vulnerability
Tech GuruQuick Answer
CVE-2026-20283 allows a remote Cisco ISE administrator to inject operating-system commands through the IPsec Open API. The node must have multiple interfaces and an active ISE-to-NAD IPsec tunnel; Cisco narrows the vulnerable configuration to API-created tunnels. Recreating the tunnel through the web interface is the documented workaround, with connectivity checks required. A CVE-specific software update remains the permanent fix.
Fix Or Immediate Action
What to do now: Confirm the affected product, release, and configuration. Apply Cisco's documented workaround as temporary risk reduction. Upgrade to the CVE-specific First Fixed release in Cisco's advisory table.
Last verified: 2026-09-17 UTC from Cisco's advisory and CSAF record. Recheck both the affected-products and fixed-software sections before a production change.
Context
Scope And Impact In Plain Language
Who should check: Anyone who manages Cisco Identity Services Engine (ISE).
When this applies: This vulnerability affects Cisco ISE if there is more than one network interface and at least one of them is configured as an active IPsec tunnel between Cisco ISE and a physical Network Access Device (NAD).
What could happen: An attacker with administrative credentials may inject operating-system commands through ISE's IPsec Open API. The affected node must have multiple network interfaces and an active IPsec tunnel; Cisco's workaround section further identifies the vulnerable API-created tunnel configuration.
Not sure? Record the node's release, interfaces, active ISE-to-NAD IPsec tunnel, and whether the tunnel was created through the API or web interface. Use the vendor's retained web-interface recreation procedure only after evaluating its effect on connectivity; do not treat any active IPsec tunnel as proof of the vulnerable configuration.
Status At A Glance
| Product scope | Cisco Identity Services Engine (ISE) |
|---|---|
| CVE | CVE-2026-20283 |
| TechGeeks response tier | P1 — urgent |
| Publication | New final Cisco advisory |
| First published | 2026-09-16T16:00:00+00:00 |
| Last updated | 2026-09-16T16:00:00+00:00 |
| Cisco advisory SIR | Critical |
| CVE-specific Cisco SIR | High |
| CVSS base score / severity | 6.5 — Medium |
| CVSS vector | CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| CISA KEV at last check | No — this is separate from Cisco severity and is not proof of no exploitation. |
| Cisco exploitation statement | The Cisco PSIRT is aware that a public announcement is available for the vulnerabilities that are described in this advisory. The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory. |
Cisco SIR note: Cisco explicitly assigns High SIR rather than the Medium indicated by the numerical CVSS score because escalation to root is easy from the achieved privilege level.
What Happened
The IPsec Open API does not adequately validate supplied input, allowing an administrator to submit commands to the underlying operating system. Cisco tracks this as CSCwu31070. Its High SIR reflects the ease of reaching root from the achieved privilege level, despite the Medium CVSS score of 6.5. The workaround section distinguishes an API-created IPsec VTI tunnel from one created through the web interface and retains the removal-and-recreation procedure and operational cautions. Cisco has released software fixes.
Affected Scope
This vulnerability affects Cisco ISE if there is more than one network interface and at least one of them is configured as an active IPsec tunnel between Cisco ISE and a physical Network Access Device (NAD).
Match the exact hardware or virtual platform, installed train, patch level, enabled service, role, and management or data-plane exposure. A Cisco product-family name alone does not establish applicability.
Steps
What To Do Now
- Confirm. Inventory Cisco Identity Services Engine (ISE) and record platform, exact release, patch level, enabled feature, role, and exposure.
- Preserve. Save UTC context plus off-device authentication, management, firewall, network, endpoint, and SIEM evidence before logs rotate or a disruptive change removes context.
- Scope. Compare each asset with the live Cisco advisory, including configuration prerequisites and exclusions.
- Reduce exposure. Evaluate and apply Cisco's temporary workaround in the highlighted panel below; it does not replace the permanent fix.
- Remediate. Follow the CVE-specific method and release guidance under Permanent Fix below.
- Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
- Escalate. If evidence or exposure creates concern, open incident response and Cisco TAC recovery work rather than treating patch completion as proof of trust.
Fixed Releases And Mitigation
Permanent Fix
Cisco method: Use the live advisory's CVE-specific First Fixed Release table.
No compact per-CVE fixed-release table is reproduced here because Cisco may use different First Fixed values by CVE and software train. Use this CVE's live advisory table or Cisco Software Checker; do not infer a fixed release from a combined hardening baseline or another Cisco notice.
Workaround Or Temporary Mitigation
There is a workaround that addresses this vulnerability. The vulnerability is present only when an IPsec VTI tunnel is created using the API. However, using the Cisco ISE web interface to create an IPsec VTI tunnel does not allow the vulnerability to be configured. If a vulnerable configuration is present, do the following: Return to Administration > System > Settings > Protocols > IPsec > Native IPsec. Choose the tunnel with the vulnerable configuration and remove it. Add the tunnel back using the web interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Important boundary: A workaround, ACL, exposure reduction, or service restriction can reduce risk while the update is prepared, but it does not patch the vulnerable code, prove every attack path is closed, or erase an earlier compromise.
Investigation And Recovery
Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.
Notes
Exploitation Evidence
Cisco's exact status at the last check: The Cisco PSIRT is aware that a public announcement is available for the vulnerabilities that are described in this advisory. The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.
This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.
Validation And Boundaries
This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2026-20283 applies. If it does, assign an owner and deadline appropriate to the Critical Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.
Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.
