OTPulse

Cisco Identity Services Engine Hardening Release: September 2026

Plan PatchCVSS 10cisco-sa-hardening-ise-XU5EwX5TSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector contain multiple critical vulnerabilities discovered during internal security review. These vulnerabilities allow unauthenticated remote attackers to execute arbitrary code, bypass authentication, or gain system access. CVSS score 10.0 (critical). Cisco has released software updates to address these issues. No workarounds are available.

What this means
What could happen
Multiple critical vulnerabilities in Cisco ISE could allow unauthenticated attackers to execute arbitrary code or bypass authentication controls, potentially compromising network access enforcement and enabling unauthorized access to your network infrastructure.
Who's at risk
Network administrators and security teams operating Cisco Identity Services Engine (ISE) for network access control, 802.1X authentication, and guest access management. Affects all ISE versions including ISE-PIC deployments used for passive identity reporting in enterprise networks, universities, and utilities with 802.1X-based network access.
How it could be exploited
An attacker with network access to the ISE appliance or its administrative interface could exploit these vulnerabilities without authentication to execute arbitrary commands, bypass authentication mechanisms, or gain elevated access to the system.
Prerequisites
  • Network access to Cisco ISE administrative or service ports
  • No authentication required
remotely exploitableno authentication requiredlow complexityhigh CVSS score (10/10)affects authentication and access control systemsmultiple internally discovered vulnerabilities
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Cisco Identity Services Engine Hardening Release: September 20261.1.0 through 3.5.0Fix available
Identity Services Engine SoftwareAll versionsFix available
ISE Passive Identity ConnectorAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/3
ISE Passive Identity Connector
HOTFIXUpdate Cisco ISE Passive Identity Connector to the latest vendor-supplied patch version
All products
HOTFIXUpdate Cisco Identity Services Engine to the latest vendor-supplied patch version immediately
WORKAROUNDRestrict network access to ISE administrative interfaces to trusted management networks only using firewall rules
Long-term hardening
0/1
HARDENINGIsolate ISE appliances on a dedicated management network segment with controlled egress to minimize attack surface
View full vendor advisory
API: /api/v1/advisories/5094048c-db02-4ff5-be82-07a1563f2d70

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.