Critical Cisco ISE Flaws Let Remote Attackers Execute Malicious Code

Cisco published an urgent advisory for two vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector: CVE-2026-20147 (critical RCE, CVSS 9.9) that can lead to full remote code execution and potential DoS in single-node deployments, and CVE-2026-20148 (path traversal, CVSS 4.9) that allows authenticated attackers to read arbitrary files. Both flaws require valid administrative credentials, have no known mitigations, and Cisco has released specific patch versions for affected ISE releases; no public proof-of-concept or observed exploitation was reported at the time of the advisory.