Cisco
Cisco Identity Services Engine: vulnerabilidades y CVE
Cisco Identity Services Engine tiene 206 vulnerabilidades publicadas, 47 de ellas en los últimos 12 meses. 17 son críticas y 4 figuran en el catálogo de explotación activa de CISA.
CVE206
Últimos 12 meses47
Críticas17
Explotadas activamente4
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-76460 | Crítica (10) | 14% | ⚠ Explotación activa | 16 sept 2026 | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API… |
| CVE-2025-20281 | Crítica (10) | 98% | ⚠ Explotación activa | 25 jun 2025 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any… |
| CVE-2025-20337 | Crítica (10) | 68% | ⚠ Explotación activa | 16 jul 2025 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any… |
| CVE-2021-44228 | Crítica (10) | 100% | ⚠ Explotación activa | 10 dic 2021 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-76460 | Crítica (10) | 14% | ⚠ Explotación activa | 16 sept 2026 | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API… |
| CVE-2026-76451 | Media (4.9) | 0.43% | — | 16 sept 2026 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.… |
| CVE-2026-76450 | Media (4.9) | 0.43% | — | 16 sept 2026 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.… |
| CVE-2026-76449 | Media (4.9) | 0.43% | — | 16 sept 2026 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.… |
| CVE-2026-76448 | Media (4.9) | 0.43% | — | 16 sept 2026 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.… |
| CVE-2026-76447 | Media (5.3) | 0.38% | — | 16 sept 2026 | A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder… |
| CVE-2026-76446 | Media (4.9) | 0.30% | — | 16 sept 2026 | A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to… |
| CVE-2026-76444 | Media (5.3) | 0.29% | — | 16 sept 2026 | A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to… |
| CVE-2026-76439 | Media (5.3) | 0.32% | — | 16 sept 2026 | A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the… |
| CVE-2026-76434 | Media (4.9) | 0.38% | — | 16 sept 2026 | A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read arbitrary files from the affected… |
| CVE-2026-76433 | Media (5.3) | 1.3% | — | 16 sept 2026 | A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to… |
| CVE-2026-76432 | Media (4.9) | 1.2% | — | 16 sept 2026 | A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device.… |
| CVE-2026-76431 | Media (4.9) | 1.2% | — | 16 sept 2026 | A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected… |
| CVE-2026-76428 | Media (4.9) | 0.48% | — | 16 sept 2026 | A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain… |
| CVE-2026-76427 | Media (4.9) | 0.46% | — | 16 sept 2026 | A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of… |
| CVE-2026-76426 | Media (4.9) | 0.48% | — | 16 sept 2026 | A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient… |
| CVE-2026-76425 | Alta (7.6) | 0.41% | — | 16 sept 2026 | A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain… |
| CVE-2026-76424 | Alta (7.2) | 0.92% | — | 16 sept 2026 | A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file… |
| CVE-2026-20352 | Alta (8.6) | 0.40% | — | 16 sept 2026 | A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due… |
| CVE-2026-20309 | Media (6.1) | 0.19% | — | 16 sept 2026 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of… |
| CVE-2026-20287 | Media (6.5) | 0.21% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a… |
| CVE-2026-20285 | Media (4.3) | 0.36% | — | 16 sept 2026 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the… |
| CVE-2026-20235 | Media (4.9) | 0.29% | — | 16 sept 2026 | A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have… |
| CVE-2026-20237 | Crítica (9.1) | 0.33% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a… |
| CVE-2026-20194 | Crítica (9.1) | 0.45% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a… |
| CVE-2026-20192 | Crítica (10) | 0.46% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a… |
| CVE-2026-20130 | Crítica (10) | 0.40% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a… |
| CVE-2026-20234 | Crítica (9.9) | 0.37% | — | 16 sept 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a… |
| CVE-2026-20146 | Media (5.5) | 0.50% | — | 15 jul 2026 | This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the… |
| CVE-2026-20190 | Alta (7.5) | 0.50% | — | 17 jun 2026 | A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.