VulnSocial

CVE-2026-20307Disclosure

MEDIUMCVSS 9.9 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-16); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-16: 1Mentions · 2026-09-17: 1Active Exploitation · 2026-09-17: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-16: 1Technical Details · 2026-09-17: 109-1609-17
Signal classification2 categories
Disclosure
150.0%
Active Exploitation
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-161
Disclosure1
2026-09-171
Active Exploitation1
Full discourse2 posts
  • Rıdvan Yağlı@ridvanyagli
    Active Exploitation

    🔴 Cisco, ISE ve Secure Firewall ürünlerinde çok sayıda kritik güvenlik açığını yayınladı! • CVE-2026-76460 — CVSS 10.0: Cisco ISE authentication bypass. Kimlik doğrulaması gerektirmiyor ve aktif olarak sömürülüyor. • CVE-2026-76423 — CVSS 10.0: ISE/ISE-PIC REST API authentication bypass. Unauthenticated admin access mümkün. • CVE-2026-20130 — CVSS 10.0: ISE/ISE-PIC injection sınıfı kritik açık. • CVE-2026-20192 — CVSS 10.0: ISE/ISE-PIC improper access control. • CVE-2026-20242 — CVSS 9.8: Secure FMC'de unauthenticated RCE, root yetkisiyle. • CVE-2026-20307 — CVSS 9.9: ISE'de authenticated RCE. • CVE-2026-20330 — CVSS 9.9: ASA/FTD/FMC'de kritik CWE-707 güvenlik açığı. Cisco, bu açıklar için güvenlik güncellemeleri yayınladı; ilgili advisories'de workaround bulunmadığı belirtiliyor. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T

    Post summary

    The text announces multiple critical Cisco vulnerabilities (CVE-2026-76460, CVE-2026-76423, CVE-2026-20130, CVE-2026-20192, CVE-2026-20242, CVE-2026-20307, CVE-2026-20330) with CVSS scores ranging from 9.8 to 10.0, explicitly claims active exploitation for CVE-2026-76460, and notes that Cisco has released security patches but no workarounds are available.

    00022472
    2.5K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-20307 A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to exe… CVSS 9.9 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20307 #Cisco #CyberSecurity #InfoSec

    Post summary

    The tweet announces a critical Cisco ISE vulnerability (CVE-2026-20307) that could allow authenticated remote code execution, cites a CVSS score of 9.9, notes no patch is currently available, and references a detailed analysis page.

    0000055
    90 followersView on X

Explore more

Back to dashboard