Cisco ISE Critical Vulnerability Requires Admin Rights (heise.de)

• Critical bug in Cisco ISE requires admin rights, enables code execution.
• Patches available for ISE 3.3-3.5; older versions unsupported.
• Additional vulnerabilities in Webex, Umbrella, Crosswork.

"Cisco released security updates for Identity Services Engine (ISE), ISE-PIC, Webex App, Umbrella Virtual Appliance, and Crosswork Network Controller. A critical vulnerability (CVE-2026-20181) in ISE and ISE-PIC requires admin privileges but allows remote code execution and privilege escalation to root via crafted HTTP requests. Patches are available for ISE versions 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 and 3.5 Patch 4 (August 2026). No active exploits reported. Additional flaws address information disclosure and privilege escalation across affected products."