Cisco has released a security update for its Identity Services Engine (ISE) to address a critical remote code execution (RCE) vulnerability, identified as CVE-2026-20181. The flaw, which carries a CVSS score of 7.2, stems from a directory traversal vulnerability within the `zipFiles` method of the software.
The vulnerability allows authenticated remote attackers to execute arbitrary code on affected ISE installations. The core issue lies in the system's failure to adequately validate user-supplied paths before utilizing them in file operations. An attacker can exploit this weakness to execute code with the privileges of the `iseadminportal` user.
Jonathan Lein of TrendAI Research is credited with discovering and reporting the vulnerability. The issue was initially reported to Cisco on February 12, 2026. Following a coordinated disclosure timeline, Cisco publicly released its security advisory and an update to correct the vulnerability on August 13, 2026.
Cisco's official security advisory, `cisco-sa-ise-multi-G5WP8vv`, provides further details on the vulnerability and the necessary patches. While authentication is required to exploit this specific flaw, its potential for remote code execution underscores the importance of applying the provided updates promptly.
