Cisco ISE SQL Injection Vulnerability (CVE-2026-20247)
CVE-2026-20247 Published on September 16, 2026

Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability
A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to modify data in the underlying database.

NVD

Vulnerability Analysis

CVE-2026-20247 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a SQL Injection Vulnerability?

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE-2026-20247 has been classified to as a SQL Injection vulnerability or weakness.


Products Associated with CVE-2026-20247

Want to know whenever a new CVE is published for Cisco Identity Services Engine Software? stack.watch will email you.

Cisco Identity Services Engine Software
 

Affected Versions

Cisco Identity Services Engine Software: