Known vulnerabilities in Cisco Identity Services Engine (ISE) - page 3

Software CPE: cpe:2.3:a:cisco_systems:cisco_identity_services_engine:*:*:*:*:*:*:*:*
Total vulnerabilities: 215
Public exploits: 4
Known exploited (KEV): 3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Identity Services Engine (ISE) Cisco Identity Services Engine (ISE) is affected by 215 known vulnerabilities: 7 critical, 8 high, 42 medium, 158 low Critical High Medium Low

Vulnerabilities (215)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150655 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-20300
CWE-89 Low
No
No
3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 17.09.2026 SB20260917224
#VU150233 - Incorrect Use of Privileged APIs
CVE-2026-76460
CWE-648 Critical
No
Exploited
3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 16.09.2026 SB2026091659
#VU138321 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20146
CWE-22 Low
No
No
- 17.07.2026 SB2026071781
#VU134760 - Improper input validation
CVE-2026-20181
CWE-20 Low
No
No
3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 4 17.06.2026 SB2026061768
#VU134761 - Improper Authorization
CVE-2026-20190
CWE-285 Medium
No
No
3.4 Patch 6, 3.5 Patch 3 17.06.2026 SB2026061768
#VU130288 - Observable Response Discrepancy
CVE-2026-20195
CWE-204 Medium
No
No
3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 07.05.2026 SB2026050720
#VU130287 - Missing Authorization
CVE-2026-20193
CWE-862 Medium
No
No
3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 07.05.2026 SB2026050720
#VU126401 - Improper Encoding or Escaping of Output
CVE-2026-20136
CWE-116 Low
No
No
3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 17.04.2026 SB2026041754
#VU126400 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20132
CWE-79 Low
No
No
3.2 Patch 8, 3.3 Patch 5, 3.4 Patch 2 17.04.2026 SB2026041752
#VU126399 - Command injection
CVE-2026-20186
CWE-77 Medium
No
No
3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4 17.04.2026 SB2026041751
#VU126398 - Command injection
CVE-2026-20180
CWE-77 Medium
No
No
3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4 17.04.2026 SB2026041751
#VU126397 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20148
CWE-22 Low
No
No
3.1 Patch 11, 3.2 Patch 10, 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 17.04.2026 SB2026041753
#VU126396 - Command injection
CVE-2026-20147
CWE-77 Medium
No
No
3.1 Patch 11, 3.2 Patch 10, 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 17.04.2026 SB2026041753
#VU121600 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20047
CWE-79 Low
No
No
3.2 P8, 3.3 Patch 8, 3.4 Patch 4 15.01.2026 SB2026011561
#VU121599 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20076
CWE-79 Low
No
No
3.2 P8, 3.3P5, 3.4P1 15.01.2026 SB2026011560
#VU121071 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-20029
CWE-611 Low
No
No
3.2 P8, 3.3 Patch 8, 3.4 Patch 4 07.01.2026 SB2026010779
#VU118128 - Incorrect Comparison
CVE-2025-20343
CWE-697 Medium
No
No
3.4 Patch 4 05.11.2025 SB2025110529
#VU118127 - Insufficient Granularity of Access Control
CVE-2025-20305
CWE-1220 Low
No
No
3.4 Patch 4 05.11.2025 SB2025110528
#VU118126 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-20304
CWE-79 Low
No
No
3.4 Patch 4 05.11.2025 SB2025110528
#VU118125 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-20303
CWE-79 Low
No
No
3.4 Patch 4 05.11.2025 SB2025110528


Showing elements 41 - 60 out of 215