CVE-2026-20130Patch(cisco / identity_services_engine)

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch cisco identity_services_engine systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

cisco CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T

Weakness type (CWE)

CWE-74

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

identity_services_engine
identity_services_engine_passive_identity_connector

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 1d ago at 3 mentions (2026-09-17); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

cisco

Products

identity_services_engineidentity_services_engine_passive_identity_connector

3 versions affected across 2 products

Deep dive

Activity timeline5 mentions / 3d

Signal classification4 categories

Patch

240.0%

Disclosure

120.0%

Active Exploitation

120.0%

General

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-16	1	Disclosure1
2026-09-17	3	Active Exploitation1General1Patch1
2026-09-22	1	Patch1

Full discourse5 posts

Rıdvan Yağlı@ridvanyagli45d
Active Exploitation
🔴 Cisco, ISE ve Secure Firewall ürünlerinde çok sayıda kritik güvenlik açığını yayınladı! • CVE-2026-76460 — CVSS 10.0: Cisco ISE authentication bypass. Kimlik doğrulaması gerektirmiyor ve aktif olarak sömürülüyor. • CVE-2026-76423 — CVSS 10.0: ISE/ISE-PIC REST API authentication bypass. Unauthenticated admin access mümkün. • CVE-2026-20130 — CVSS 10.0: ISE/ISE-PIC injection sınıfı kritik açık. • CVE-2026-20192 — CVSS 10.0: ISE/ISE-PIC improper access control. • CVE-2026-20242 — CVSS 9.8: Secure FMC'de unauthenticated RCE, root yetkisiyle. • CVE-2026-20307 — CVSS 9.9: ISE'de authenticated RCE. • CVE-2026-20330 — CVSS 9.9: ASA/FTD/FMC'de kritik CWE-707 güvenlik açığı. Cisco, bu açıklar için güvenlik güncellemeleri yayınladı; ilgili advisories'de workaround bulunmadığı belirtiliyor. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T
Post summary
Cisco disclosed multiple critical CVEs (CVSS 9.8‑10.0) affecting ISE and Secure Firewall products, with at least one actively exploited, and released security patches while noting no workarounds are available.
00022472
2.5K followersView on X
SecAlerts@SecAlertsCo41d
Patch
🛡️ Cisco ISE: CVSS 10 — CVE-2026-20130 is an improper neutralization flaw. No auth, full RCE impact. Patch now. #cisco #cybersecurity #ciso #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-20130?utm_campaign=x https://t.co/C9E6NTUGsR
Post summary
The tweet highlights CVE-2026-20130 in Cisco ISE as an unauthenticated RCE flaw with CVSS 10 and urges immediate patching.
00001160
890 followersView on X
ExploitGrid@exploitgrid45d
Patch
[CVE] CVE-2026-20130 [HIGH PRIORITY] #Cisco Identity Services Engine Hardening Release - Improper Neutralization Vu... 🔗 https://exploitgrid.net/cve/CVE-2026-20130
Post summary
The post announces CVE-2026-20130 affecting Cisco Identity Services Engine, classifies it as a High Priority Improper Neutralization vulnerability, and highlights the availability of a Hardening Release (patch) for remediation.
1000043
48 followersView on X
ExploitGrid@exploitgrid45d
General
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-20130 CVE-2026-20192 CVE-2026-70416 CVE-2026-73453 CVE-2026-73456 ..🧵👇
Post summary
The text is a brief threat digest listing five CVE identifiers without any accompanying technical details, exploit references, or remediation information. The tweet serves as an announcement or pointer to further details (suggested by the thread indicator ..🧵👇) but provides no substantive information beyond the CVE numbers themselves.
1000067
48 followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-20130 Cisco Advance Notification for Publication of September 16, 2026, Security Advisories CVSS 10.0 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20130 #Cisco #CyberSecurity #InfoSec
Post summary
The tweet announces CVE-2026-20130, a critical Cisco vulnerability with a CVSS score of 10.0 and no patch available, focusing on the upcoming publication of security advisories.
0000030
90 followersView on X

CPE platform detail42 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

42 of 42 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cisco	identity_services_engine	-	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	-	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-

Explore more

Back to dashboard cisco CVEs identity_services_engine vulnerabilities

What researchers are saying

CVE-2026-20130

Rıdvan Yağlı[verified]@ridvanyagliActive Exploitation

Cisco disclosed multiple critical CVEs (CVSS 9.8‑10.0) affecting ISE and Secure Firewall products, with at least one actively exploited, and released security patches while noting no workarounds are available.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet announces CVE-2026-20130, a critical Cisco vulnerability with a CVSS score of 10.0 and no patch available, focusing on the upcoming publication of security advisories.

SecAlerts@SecAlertsCoPatch

The tweet highlights CVE-2026-20130 in Cisco ISE as an unauthenticated RCE flaw with CVSS 10 and urges immediate patching.

ExploitGrid@exploitgridPatch

The post announces CVE-2026-20130 affecting Cisco Identity Services Engine, classifies it as a High Priority Improper Neutralization vulnerability, and highlights the availability of a Hardening Release (patch) for remediation.

ExploitGrid@exploitgridGeneral

The text is a brief threat digest listing five CVE identifiers without any accompanying technical details, exploit references, or remediation information. The tweet serves as an announcement or pointer to further details (suggested by the thread indicator ..🧵👇) but provides no substantive information beyond the CVE numbers themselves.