cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #emerging

Cisco ISE directory traversal and command injection

Luke Johnson / Cyber Research US

Summary

Public ZDI advisories (coordinated 2026-08-13) describe four Cisco Identity Services Engine (ISE) flaws: unauthenticated information disclosure via upgrade-file handling, two authenticated directory-traversal bugs, and authenticated command injection. Three issues run in the iseadminportal user context; one unauthenticated bug may leak stored credentials. This memo synthesizes those public ZDI write-ups only; exploitation in the wild is not claimed, and the issues were not independently reversed here.

Attack vector

Attackers reach ISE over the network (AV:N, no user interaction). CVE-2026-20190 requires no authentication and targets functionality that handles upgrade files. The other three require an already-authenticated high-privilege session (PR:H) and then invoke specific ISE methods: PatchUpdateListener (path-controlled file read), zipFiles (path-controlled file operations), and invokeScript (user-controlled string passed into a system call). A realistic chain is unauthenticated credential disclosure followed by authenticated RCE/read as iseadminportal.

Exploit

  • CVE-2026-20190 (ZDI-26-580 / ZDI-CAN-29246): missing authentication on a critical function that handles upgrade files. Unauthenticated remote access to that functionality can disclose sensitive data, including stored credentials that ZDI says may enable further compromise (ZDI).
  • CVE-2026-20148 (ZDI-26-582 / ZDI-CAN-28708): directory traversal in PatchUpdateListener. A user-supplied path is not validated before file operations, allowing disclosure of files in the iseadminportal context (ZDI).
  • CVE-2026-20181 (ZDI-26-579 / ZDI-CAN-29197): directory traversal in zipFiles. The same class of unsanitized path is used in file operations and is assessed as arbitrary code execution as iseadminportal (ZDI).
  • CVE-2026-20147 (ZDI-26-581 / ZDI-CAN-28709): command injection in invokeScript. A user-supplied string is not validated before it is used in a system call, yielding RCE as iseadminportal (ZDI).

No public PoC, request parameters, or exploit tooling are stated in these advisories.

In the wild / novelty

Not stated. These are coordinated disclosures: Jonathan Lein reported the PatchUpdateListener and invokeScript issues to Cisco on 2025-12-18; Lein reported zipFiles and Bobby Gould reported the unauthenticated upgrade-file issue on 2026-02-12; ZDI and Cisco published on 2026-08-13. ZDI does not claim honeypot hits, victim exploitation, or a public exploit.

Risk

ISE is a central NAC/identity control plane. Successful abuse can leak high-value secrets (including stored credentials) or execute code as iseadminportal, with confidentiality/integrity/availability impact on the appliance for the RCE bugs (CVSS 7.2 authenticated; 7.5 unauthenticated disclosure; 4.9 authenticated file read). Blast radius is any reachable ISE instance that still exposes the vulnerable listeners/methods; compromise can undermine network access policy, admin sessions, and further lateral movement if leaked credentials are reusable.

Remediation

Apply the Cisco updates referenced by ZDI: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ (CVE-2026-20147, CVE-2026-20148) and hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv (CVE-2026-20181, CVE-2026-20190). Restrict management-plane access to ISE to trusted admin networks; treat any pre-patch exposure of upgrade-file handling as a credential-reset event. Hunt for unexpected authenticated use of invokeScript, zipFiles, and PatchUpdateListener, and for unauthenticated access to upgrade-file endpoints. Validate by confirming the Cisco fixed release is installed and those advisory IDs no longer apply to the build.

CVE / identifiers

CVE-2026-20147 (ZDI-26-581, ZDI-CAN-28709); CVE-2026-20148 (ZDI-26-582, ZDI-CAN-28708); CVE-2026-20181 (ZDI-26-579, ZDI-CAN-29197); CVE-2026-20190 (ZDI-26-580, ZDI-CAN-29246); Cisco advisories cisco-sa-ise-rce-traversal-8bYndVrZ and cisco-sa-ise-multi-G5WP8vv.

Confidence

medium — ZDI advisories agree on product, method names, bug class, auth requirements, and impact user, but this is public-reporting synthesis only (no Cisco advisory body text in-cluster, no independent lab confirmation, no IOCs or request-level detail).

Open questions

Affected ISE versions and exact fixed builds are not in the ZDI pages. Whether zipFiles traversal is write-to-webroot/library-load versus another RCE primitive is unspecified. How upgrade-file handling is reached (protocol, path, listener) and which credential stores are readable are not described. No statement on whether the unauthenticated leak is sufficient to obtain the PR:H session needed for the other three bugs. In-the-wild status is unknown.

Sources