CVE-2026-20300: Cisco ISE SQL Injection Vulnerability

CVE-2026-20300 Overview

CVE-2026-20300 is a SQL injection vulnerability in Cisco Identity Services Engine (ISE). An authenticated remote attacker with low-privileged administrative credentials can send crafted requests to read or modify data in the underlying database. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Successful exploitation allows an attacker with low-privileged administrative credentials to read or modify data in the Cisco ISE backend database, undermining the integrity of the identity and access control system.

Affected Products

Cisco Identity Services Engine (ISE)
Refer to the Cisco Security Advisory for the definitive list of affected versions
Deployments where administrative access is delegated to multiple operators are at highest risk

Discovery Timeline

2026-09-16 - CVE-2026-20300 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-20300

Vulnerability Analysis

Cisco ISE is a network access control and policy enforcement platform used to authenticate and authorize endpoints across enterprise networks. The vulnerability exists in an administrative interface that accepts user-supplied input and incorporates it into SQL statements without adequate validation.

An authenticated attacker sends a crafted request containing SQL syntax through the affected parameter. The application passes the tainted input into a database query, allowing the attacker to alter query logic. The result is unauthorized read access and the ability to modify records in the ISE database.

Because ISE stores authentication policies, RADIUS configuration, endpoint identities, and administrative credentials, database tampering can affect network access decisions across the environment.

Root Cause

The root cause is improper validation and neutralization of user-supplied input before it is used in SQL queries [CWE-89]. The application does not use parameterized queries or adequate input sanitization for the affected fields, allowing SQL metacharacters to alter query intent.

Attack Vector

The attack vector is network-based. The attacker must first authenticate with at least low-privileged administrative credentials to reach the vulnerable endpoint. Once authenticated, the attacker submits a crafted HTTP request containing SQL injection payloads in a vulnerable parameter. Exploitation does not require user interaction. Confidentiality is limited to database contents accessible to the ISE service account, while integrity impact is high because arbitrary write operations against the database are possible. See the Cisco Security Advisory for endpoint specifics.

No public proof-of-concept code is available at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-20300

Indicators of Compromise

Administrative HTTP requests to Cisco ISE containing SQL metacharacters such as single quotes, UNION SELECT, --, or /* in parameter values
Unexpected modifications to ISE policy, endpoint, or administrator tables not tied to documented change tickets
Authentication attempts from low-privileged admin accounts followed by anomalous database activity or configuration changes
ISE application or database logs showing SQL syntax errors triggered by administrative sessions

Detection Strategies

Enable verbose administrative audit logging on Cisco ISE and forward logs to a central analytics platform for correlation
Baseline normal request patterns for each administrator role and alert on parameter values that deviate from expected input types
Correlate ISE audit events with database change events to identify writes that lack a corresponding authorized workflow
Review privileged account inventories to reduce the number of low-privileged administrative credentials that could be abused

Monitoring Recommendations

Monitor all administrative sessions to ISE for injection patterns using a web application firewall or reverse proxy with SQL injection signatures
Alert on any use of dormant or service-tier administrative accounts against ISE management interfaces
Track outbound data volumes from ISE nodes to detect large database reads consistent with data exfiltration

How to Mitigate CVE-2026-20300

Immediate Actions Required

Apply the fixed Cisco ISE release identified in the Cisco Security Advisory as soon as change windows allow
Restrict access to ISE administrative interfaces to a dedicated management network reachable only from trusted jump hosts
Audit all administrative accounts, remove unused low-privileged accounts, and rotate credentials for accounts that remain
Enforce multi-factor authentication for all ISE administrative logins to raise the bar for credential-based access

Patch Information

Cisco has published fixed software releases for affected Cisco ISE versions. Consult the Cisco Security Advisory cisco-sa-ise-sql-inj-3QTKR947 for the specific fixed release train that applies to your deployment, and follow Cisco's documented upgrade procedure for ISE clusters to avoid policy service disruption.

Workarounds

Cisco has not published a supported workaround; upgrading to a fixed release is the recommended remediation
As an interim compensating control, limit administrative access to a small set of source IP addresses on the management network
Reduce the number of administrator accounts with any level of privilege until patching is complete

bash

# Example: restrict Cisco ISE administrative access to a management subnet
# Apply on the upstream firewall or ISE management ACL
access-list ISE_MGMT permit tcp 10.10.20.0 0.0.0.255 host <ISE_MGMT_IP> eq 443
access-list ISE_MGMT deny   tcp any host <ISE_MGMT_IP> eq 443
access-list ISE_MGMT permit ip any any