CVE-2026-20247 PUBLISHED

Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability

Assigner: cisco
Reserved: 08.10.2025 Published: 16.09.2026 Updated: 16.09.2026

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device.

This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to modify data in the underlying database.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor Cisco
Product Cisco Identity Services Engine Software
Versions Default: unknown
  • Version 3.1.0 is affected
  • Version 3.1.0 p1 is affected
  • Version 3.1.0 p3 is affected
  • Version 3.1.0 p2 is affected
  • Version 3.2.0 is affected
  • Version 3.1.0 p4 is affected
  • Version 3.1.0 p5 is affected
  • Version 3.2.0 p1 is affected
  • Version 3.1.0 p6 is affected
  • Version 3.2.0 p2 is affected
  • Version 3.1.0 p7 is affected
  • Version 3.3.0 is affected
  • Version 3.2.0 p3 is affected
  • Version 3.2.0 p4 is affected
  • Version 3.1.0 p8 is affected
  • Version 3.2.0 p5 is affected
  • Version 3.2.0 p6 is affected
  • Version 3.1.0 p9 is affected
  • Version 3.3 Patch 2 is affected
  • Version 3.3 Patch 1 is affected
  • Version 3.3 Patch 3 is affected
  • Version 3.4.0 is affected
  • Version 3.2.0 p7 is affected
  • Version 3.3 Patch 4 is affected
  • Version 3.4 Patch 1 is affected
  • Version 3.1.0 p10 is affected
  • Version 3.3 Patch 5 is affected
  • Version 3.3 Patch 6 is affected
  • Version 3.4 Patch 2 is affected
  • Version 3.3 Patch 7 is affected
  • Version 3.4 Patch 3 is affected
  • Version 3.5.0 is affected
  • Version 3.4 Patch 4 is affected
  • Version 3.3 Patch 8 is affected
  • Version 3.2 Patch 8 is affected
  • Version 3.5 Patch 1 is affected
  • Version 3.3 Patch 9 is affected
  • Version 3.2 Patch 9 is affected
  • Version 3.4 Patch 5 is affected
  • Version 3.5 Patch 3 is affected
  • Version 3.5 Patch 2 is affected
  • Version 3.3 Patch 10 is affected
  • Version 3.3 Patch 11 is affected
  • Version 3.4 Patch 6 is affected
  • Version 3.2 Patch 10 is affected
  • Version 3.1.0 p72 is affected
  • Version 3.1.0 p11 is affected

Exploits

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

References

Problem Types

  • Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') cwe