Cisco ISE: Authenticated RCE in invokeScript With Root…

CVE-2026-20147 enables authenticated remote code execution as the iseadminportal user on Cisco Identity Services Engine, with a documented privilege escalation path to root. The flaw requires valid admin credentials but poses critical risk in single-node deployments where exploitation also triggers a denial-of-service condition.

A command injection vulnerability in the invokeScript method of Cisco Identity Services Engine (ISE) allows an authenticated remote attacker to execute arbitrary code as the iseadminportal user, with a documented path to root privilege escalation. The coordinated advisory release is dated August 13, 2026; the gap between discovery on December 18, 2025, and public disclosure underscores the complexity of patching a widely deployed network access control product.

Key Takeaways

CVE-2026-20147 resides in the invokeScript method of Cisco ISE, where user input is not validated before a system call
The attacker must possess valid administrative credentials; exploitation occurs within an authenticated session
Initial execution runs as the iseadminportal service account, with a vendor-documented path to root privilege escalation
In single-node deployments, exploitation renders the node unavailable and blocks authentication for new endpoints

The Mechanism: Unvalidated Input Concatenated Into a System Call

According to advisory ZDI-26-581, the specific flaw exists in the implementation of the invokeScript method:

"The specific flaw exists within the implementation of the invokeScript method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call."

ISE's architecture tasks invokeScript with performing administrative operations on the underlying system. The missing validation allows an attacker to inject shell metacharacters or commands into user-supplied input, which the operating system then interprets. This command injection pattern is especially dangerous in Network Access Control (NAC) platforms where the boundary between the management interface and the kernel is functionally permeable.

ZDI specifies that execution occurs in the context of the iseadminportal user, a service account with significant application privileges though not immediately equivalent to root. The escalation path, documented by Cisco, turns this condition into full system compromise.

From User to Root: The Documented Escalation Path

The Cisco advisory adds a critical detail beyond the ZDI publication. According to the vendor, a successful exploit allows an attacker to:

"obtain user-level access to the underlying operating system and then elevate privileges to root"

This statement, present in the official text, reframes the risk assessment. An authenticated RCE with limited application privileges remains containable; the same mechanism with a verified path to root compromises the entire host and, by extension, the access policies managed by the ISE node.

The CVSS 3.1 vector confirms this severity: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The S:C (Scope Changed) component is particularly significant: impact extends beyond the vulnerable component to the underlying operating system and potentially to other nodes in the deployment.

Single-Node: When DoS Becomes Operational Criticality

An often overlooked dimension of RCE advisories is the collateral effect on availability. Cisco specifies that in single-node deployments:

"successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition"

The combination of RCE and DoS in a single-node architecture eliminates the redundancy that would otherwise allow failover. Organizations with this deployment model — common in SMBs or remote branches — suffer not only a breach but a paralysis of new endpoint onboarding. By definition, NAC is an inline component: when it falls, access management halts.

Authentication as a Prerequisite: Lesser but Not a Mitigation

The requirement for administrative credentials (PR:L in the vector) has fueled optimistic readings. That is a mistake. Cisco ISE is an access control system; its administrators hold visibility into network policies, identities, posture assessment, and guest services. Compromise of these credentials occurs through well-documented techniques — targeted phishing, social engineering, credential stuffing, or lateral movement from previously compromised endpoints — not necessarily requiring a direct attack on the product itself.

The brief documents no in-the-wild exploitation: Cisco PSIRT is not aware of public announcements or confirmed malicious use at the time of the advisory. This absence does not establish absence of risk; it simply notes absence of formal confirmation.

Immediate Actions

Four priority actions, all derived from the documented facts in the sources:

Apply the software updates released by Cisco: the vendor has made patches available; no alternative workarounds exist
Verify the ISE release in use: versions prior to 3.1 require migration to fixed releases; ISE-PIC is end-of-sale and receives no updates
Review administrative access: audit which accounts hold valid credentials on ISE nodes, with particular attention to shared or service accounts
Evaluate deployment architecture: single-node deployments present both compromise and availability risks; plan redundancy where technically feasible

The Parable of the Compromised NAC

Network Access Control is designed to be the guardian of the internal perimeter. When the guardian itself hosts a flaw that enables RCE with a path to root, the trust hierarchy inverts: the infrastructure that authenticates becomes the vector of compromise. The CVSS 9.9 metric is not hyperbole but a logical consequence of S:C — scope escalation — applied to so central a component.

The technical lesson lies in the implementation detail: an administrative method (invokeScript) that executes system calls without input sanitization. The operational lesson lies in the management of the credentials that protect this method. Both demand immediate attention.

FAQ

Is the numeric CVSS score confirmed beyond the vector?

The CVSS:3.1 vector is documented by Cisco; the explicit numeric score is not reported in the extracted text of the available sources.

Are public proof-of-concept exploits available?

The dossier contains no references to available PoCs; ZDI has not published payload details in the released advisory.

Is ISE-PIC vulnerable?

Cisco includes ISE-PIC in the advisory for the same product family, but the product is end-of-sale and receives no fixes: it requires replacement or migration.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references