Cisco ISE Authenticated RCE Escalates to Root: The 9.9 CVSS…

A critical vulnerability in Cisco Identity Services Engine enables authenticated remote code execution with privilege escalation to root. The official CVE record scores it 9.9 CRITICAL, contradicting the initial 7.2 from the Trend Micro Zero Day Initiative — here's why the discrepancy masks a more extensive exploit chain.

Cisco published the coordinated advisory release for CVE-2026-20147 on August 13, 2026, a command injection in the invokeScript method of Identity Services Engine. The vulnerability allows a remote attacker with administrative credentials to execute arbitrary code, gain access to the underlying operating system, and escalate privileges to root. The official CVE record's CVSS 9.9 CRITICAL score — against the 7.2 listed in the Trend Micro Zero Day Initiative advisory — reveals an exploit chain more extensive than the initial classification suggested.

Key Takeaways

The command injection resides in Cisco ISE's invokeScript method, with missing validation of user input before a system call
Exploitation requires administrative authentication but enables execution as iseadminportal with a documented path to root privileges
The official CVE record assigns CVSS 9.9 CRITICAL, while the published ZDI advisory lists 7.2: the two sources diverge on the overall impact assessment
In single-node deployments, exploitation can cause node unavailability with consequent DoS for endpoints not yet authenticated

The Mechanism: Why invokeScript Became an RCE Vector

The specific flaw exists in the implementation of the invokeScript method. The problem stems from the lack of validation of a user-supplied string before its use in executing a system call. This gap turns an apparently routine operation into a remotely controllable command injection channel.

Authentication is a necessary condition: the attacker must possess valid administrative credentials. Once past this check, the vulnerability allows code execution in the context of the iseadminportal user. The CVE record and Cisco advisory indicate the attacker obtains "user-level access to the underlying operating system" and subsequently "elevate privileges to root." The full path is documented, not inferred: authentication, command injection, execution in the service context, local escalation.

The attack vector is remote — network attack vector — with low attack complexity and limited privilege requirements (product administrator, not operating system). The CVSS Scope field in the official record is marked Changed: impact exceeds the vulnerable component boundary, extending to the underlying host.

The CVSS Discrepancy: 9.9 vs 7.2, Two Readings of the Same Bug

The CVE-2026-20147 record assigns a score of 9.9 with CRITICAL severity, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The published ZDI advisory instead reports 7.2 for the same identifier. The gap between the two values is not marginal: it marks the boundary between a severe vulnerability and a maximum criticality.

The explanation likely lies in the different assessment of escalation and scope. The CVE record explicitly integrates the possibility of obtaining operating system access and escalating privileges to root, an element that raises Confidentiality, Integrity, and Availability to maximum (H/H/H) with changed scope. The ZDI advisory, lacking extended technical details, presents a more conservative score that does not reflect the complete chain. For organizations relying on CVSS for prioritization, the official CVE record number — 9.9 — is the binding one.

"An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root."
— Cisco Security Advisory, CVE-2026-20147

The Risk Profile: NAC Compromised, Internal Perimeter Exposed

Cisco Identity Services Engine is the heart of Network Access Control in large enterprise infrastructures: it governs device authentication, VLAN assignment, compliance policies. An RCE with root on this component is not a lateral compromise: it is a takeover of the console that defines who can enter the network.

The administrative credential requirement does not constitute a sufficient barrier. Insiders with legitimate access, admin accounts compromised via phishing or password reuse, abused elevation sessions: all these scenarios remove the authentication filter without requiring an initial attack external to the machine. Additionally, the potential DoS on single-node deployments adds a concrete operational risk: a non-redundant ISE node that becomes unavailable disrupts onboarding of new endpoints, with a cascading effect on corporate connectivity.

Cisco PSIRT, in its advisory, states it is not aware of public or malicious use of the vulnerability at the time of publication. This does not rule out private analysis or undetected exploits in circulation.

What to Do Now

Verify the installed Cisco ISE version: releases prior to 3.1 are vulnerable, with fixes available in the official Cisco advisory
Apply the software updates released by the vendor: no alternative documented workarounds exist for this vulnerability
Review administrative access to ISE, favoring accounts with limited scope and monitoring elevation sessions
Assess deployment redundancy: the absence of secondary nodes exposes to DoS in case of successful exploitation

The Silence on Escalation: What Cisco Does Not Detail

Both the Cisco advisory and the CVE record state that the attacker can escalate privileges to root, but none of the available sources specify the local mechanism used. It does not emerge whether this is a second vulnerability in the underlying operating system, a misconfiguration of the iseadminportal service permissions, or another known but unmitigated privilege escalation path.

This omission is relevant for two reasons. First: without knowing the mechanism, it is impossible to assess whether the same escalation applies to other access vectors or different post-exploitation scenarios. Second: the Scope: Changed field of CVSS 9.9 assumes impact exceeds the vulnerable component boundaries, but documentation does not clarify whether the Cisco patch addresses only input validation in invokeScript or also the execution context permissions. The dossier does not specify the full scope of the fix.

Also undocumented is the differentiated impact between standard ISE and ISE-PIC (Passive Identity Connector), both cited in the Cisco advisory but without detail on specific affected intermediate versions.

Adoption of the CVE 9.9 score by enterprise security teams is the prudent choice. The distance from the 7.2 ZDI score is not a classification error: it is the measure of an exploit chain that the Trend Micro advisory presented in compact form, while the official record explicitated in its entirety.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references