Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-20284: Cisco ISE SXP API lets admin attacker alter data
CVE-2026-20284 · published 26 days ago
Summary
The Cisco Identity Services Engine’s SXP REST interface can be tricked into running unintended database commands if a user with valid admin credentials sends specially crafted requests. This could let an attacker view or change stored information and, in single‑node setups, potentially make the ISE service unavailable, blocking network access for unauthenticated devices. To protect yourself, apply the latest Cisco security updates and ensure only trusted administrators have access to the API.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | cisco identity services engine software | 3.1.0 |
Original advisory text
Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-943Improper Neutralization of Special Elements in Data Query Logic
Timeline
Published16 Sep 2026
Updated11 Oct 2026
First seen16 Sep 2026
Track software like this
Free during beta