Vulnerabilities
Cisco ISE invokeScript Command Injection Enables Remote Code Execution (CVE‑2026‑20147)
Cisco Identity Services Engine (ISE) is vulnerable to a command‑injection flaw that allows authenticated attackers to execute arbitrary code as the iseadminportal user. The CVE‑2026‑20147 advisory recommends applying the vendor patch immediately and tightening administrative access.
On August 13 2026 Cisco released a security advisory for a command‑injection flaw in the invokeScript method of its Identity Services Engine (ISE). The vulnerability, assigned CVE‑2026‑20147, allows authenticated attackers to execute arbitrary code as the iseadminportal user, resulting in full system compromise.
“Cisco has issued an update to correct this vulnerability.”
What happened
The flaw originates from missing validation of a user‑supplied string before it is passed to a system call within invokeScript. An attacker with valid ISE credentials can supply crafted input that is executed on the host, giving remote code execution (RCE) capabilities.
Impact
- Remote code execution with the privileges of the iseadminportal account.
- Potential for data exfiltration, lateral movement, and full takeover of the ISE appliance.
- CVSS score 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
What to do
Defenders should immediately check the ISE version in use. Cisco has released a patch that validates the input to invokeScript. Apply the update as soon as possible, verify the change, and audit access logs for any anomalous invokeScript activity. Restrict ISE administrative access to trusted hosts and enable multi‑factor authentication where available.
Related vulnerabilities
CVE-2026-69370: Visual Studio Code Remote Code Execution via Command Injection
A command injection flaw in Visual Studio Code enables attackers to execute arbitrary code remotely. All versions that accept untrusted input in the command execution path are affected. Defenders should apply the latest update and audit remote access settings.
Read briefing
Cisco Secure Email Gateway CVE-2026-76461 Zero-Day Exploited in the Wild
Cisco has patched a critical SQL injection vulnerability, tracked as CVE-2026-76461, in the AsyncOS software used by Cisco Secure Email Gateway. The flaw allows unauthenticated, remote attackers to achieve root-level command execution via crafted emails and is actively exploited in the wild. SecOps and sysadmins must immediately apply the vendor-supplied firmware updates.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Read briefing