CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product cisco:identity_services_engine. Show all products

42 CVEs, showing 1 to 42
CVESeverityTitlePublished
CVE-2021-44228
Known exploited
Critical 10.0Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Assigned by apache
Dec 10, 2021
CVE-2025-20281
Known exploited
Critical 10.0Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Assigned by cisco
Jun 25, 2025
CVE-2025-20337
Known exploited
Critical 10.0Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Assigned by cisco
Jul 16, 2025
CVE-2025-20289Medium 5.4Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the int…Nov 5, 2025
CVE-2025-20303Medium 5.4Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the int…Nov 5, 2025
CVE-2025-20304Medium 5.4Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the int…Nov 5, 2025
CVE-2025-20305Medium 4.9A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device.Nov 5, 2025
CVE-2025-20343High 7.5A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco…Nov 5, 2025
CVE-2026-20047Medium 4.8A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to condu…Jan 15, 2026
CVE-2026-20076Medium 4.8A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack again…Jan 15, 2026
CVE-2026-20132Medium 4.8Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to condu…Apr 15, 2026
CVE-2026-20136Medium 6.0A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges…Apr 15, 2026
CVE-2026-20147Critical 9.9A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.Apr 15, 2026
CVE-2026-20148Medium 4.9A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files.Apr 15, 2026
CVE-2026-20180Critical 9.9A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.Apr 15, 2026
CVE-2026-20186Critical 9.9A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.Apr 15, 2026
CVE-2026-20193Medium 4.3A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive inf…May 6, 2026
CVE-2026-20195Medium 5.3A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affected device.May 6, 2026
CVE-2026-20181Critical 9.1A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.Jun 17, 2026
CVE-2026-20190High 7.5A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device.Jun 17, 2026
CVE-2026-20146Medium 5.5A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the under…Jul 15, 2026
CVE-2026-20234Critical 9.9Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities
Assigned by cisco
Sep 16, 2026
CVE-2026-20192Critical 10.0Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
Assigned by cisco
Sep 16, 2026
CVE-2026-20130Critical 10.0Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
Assigned by cisco
Sep 16, 2026
CVE-2026-76460
Known exploited
Critical 10.0Cisco Identity Services Engine Authentication Bypass Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76424High 7.2Cisco ISE Arbitrary File Access Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76425High 7.6Cisco ISE SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76439Medium 5.3Cisco Identity Services Engine Event Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76433Medium 5.3Cisco Identity Services Engine Information Disclosure Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76428Medium 4.9Cisco ISE Profiler SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76450Medium 4.9Cisco Identity Services Engine SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76449Medium 4.9Cisco Identity Services Engine SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76451Medium 4.9Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76444Medium 5.3Cisco Identity Services Engine Information Disclosure Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76434Medium 4.9Cisco Identity Services Engine Arbitrary File Read Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76448Medium 4.9Cisco Identity Services Engine SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76432Medium 4.9Cisco Identity Services Engine Arbitrary File Write Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76446Medium 4.9Cisco Identity Services Engine External Entity Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76447Medium 5.3Cisco Identity Services Engine Certificate Reload Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76427Medium 4.9Cisco ISE XML External Entity Injection Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76431Medium 4.9Cisco Identity Services Engine Arbitrary File Deletion Vulnerability
Assigned by cisco
Sep 16, 2026
CVE-2026-76426Medium 4.9Cisco ISE REST API SQL Injection Vulnerability
Assigned by cisco
Sep 16, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.