Cisco fixed a critical ISE vulnerability that lets attackers to gain root access

A critical vulnerability in Cisco's Identity Services Engine (ISE) has been patched, preventing attackers from gaining root access to the system. The flaw, tracked as CVE-2026-20181, carried a CVSS score of 9.1 and allowed authenticated administrators to execute commands on the underlying operating system by sending crafted HTTP requests¹. This was made possible by improper validation of user-supplied input, enabling privilege escalation and full root access. The vulnerability affected both ISE and ISE-PIC, highlighting the need for swift patching to prevent exploitation. Given its high severity, the exploitation status of CVE-2026-20181 is being closely monitored by Cisco. This vulnerability matters to practitioners because it underscores the importance of keeping systems up-to-date with the latest security patches to prevent attackers from exploiting known vulnerabilities and gaining unauthorized access to sensitive systems.