CVE-2026-20147

CVE-2026-20186: A remote attacker with low privileges and without user interaction can inject commands to escalate privileges to root. If the ISE deployment is single-node, then that can cause Denial-of-Service (DoS). CVE-2026-20147: A remote attacker with low privileges and without user interaction can send crafted HTTP requests to execute arbitrary commands on the underlying operating system to elevate their privileges to root. If the ISE deployment is single-node, then that can cause Denial-of-Service (DoS). CVE-2026-20180: A remote attacker with low privileges and no user interaction can send crafted HTTP requests to execute code remotely because of insufficient validation of user-supplied input in HTTP request handling. That way they can raise their privileges to root and compromise the system.

EPSS 0.32% · 55.5th percentile