Skip to content
Sign in
CVE-2026-202849.1CriticalCWE-943

Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability

Cisco · Cisco Identity Services Engine Software

Not in CISA KEV
0.5%probability of exploitation in the next 30 days
45th percentile
050100

Higher than 45% of scored CVEs

9.1CriticalCVSS 3.1
LowCrit.

DescriptionNVD

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 17 Sep.

Full timeline
Quiet for 6 weekslast report 17 Sep2 articles2 outlets
17 Sep · SecurityOnline first11 Oct19 OctNow
  • Thu 17 Sep, 02:36 UTC. SecurityOnline, first report. Cisco Patches Critical ISE Flaws Enabling Unauthenticated Admin Access.
  • Thu 17 Sep, 12:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation.
All coveragerunning total2SecurityOnl…1SecurityWeek117 Sep3 Oct19 OctNow
  • First report
  • Article
  • Running total
Show as table
2 articles about CVE-2026-20284 from 2 outlets
Published (UTC)OutletHeadline
17 Sep 02:36SecurityOnlineCisco Patches Critical ISE Flaws Enabling Unauthenticated Admin Access
17 Sep 12:30SecurityWeekCisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation
  1. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation
    SecurityWeek · mentions it in passing
  2. Cisco Patches Critical ISE Flaws Enabling Unauthenticated Admin Access
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in