CVE-2026-20352 Overview
Cisco Identity Services Engine (ISE) contains a denial of service vulnerability in its RADIUS feature. An unauthenticated, remote attacker can send a crafted RADIUS request directly to an affected device to trigger the condition. Successful exploitation causes the ISE node to become unavailable. In single-node deployments, endpoints that have not already authenticated cannot access the network until the node recovers on its own. The flaw is tracked under CWE-119 (improper restriction of operations within the bounds of a memory buffer). Cisco published the advisory on September 16, 2026.
Critical Impact
A single crafted RADIUS packet from an unauthenticated network attacker can disable authentication services on an affected ISE node, blocking network access for unauthenticated endpoints.
Affected Products
- Cisco Identity Services Engine (ISE) — RADIUS feature
- Single-node ISE deployments (highest impact due to lack of failover)
- Refer to the Cisco Security Advisory for fixed release information
Discovery Timeline
- 2026-09-16 - CVE-2026-20352 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-20352
Vulnerability Analysis
The vulnerability resides in the RADIUS (Remote Authentication Dial-In User Service) processing path of Cisco ISE. Cisco categorizes the flaw under [CWE-119], indicating improper restriction of operations within the bounds of a memory buffer. An attacker sends a crafted RADIUS request directly to the affected device across the network. The malformed request is not handled correctly, and the ISE node becomes unavailable.
Because ISE acts as the RADIUS authentication authority, its unavailability prevents new network access decisions. In single-node deployments, endpoints that have not yet authenticated cannot join the network until the node recovers. Distributed deployments with policy service node redundancy reduce this exposure but do not eliminate the underlying processing defect.
Root Cause
Cisco attributes the issue to improper handling of certain RADIUS requests. The improper handling aligns with [CWE-119], suggesting a boundary condition in how the RADIUS parser processes attributes or headers. Malformed input drives the process into an unavailable state rather than being rejected safely.
Attack Vector
The attack is unauthenticated and executed over the network. An attacker only needs reachability to the RADIUS service on the ISE node (typically UDP/1812 and UDP/1813). No user interaction is required. The impact is limited to availability; confidentiality and integrity are not affected. The scope changes because a failure in ISE affects downstream network access enforcement points.
Exploitation code is not publicly available at this time. See the Cisco Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-20352
Indicators of Compromise
- Unexpected restarts, crashes, or unresponsiveness of the Cisco ISE RADIUS process or node.
- Sudden failures of RADIUS authentication requests from network access devices (switches, wireless controllers, VPN concentrators).
- Unusual volumes or patterns of RADIUS Access-Request packets from unexpected source addresses.
Detection Strategies
- Inspect RADIUS traffic for malformed attributes, oversized fields, or requests from sources outside the authorized network access device (NAD) list.
- Correlate NAD authentication failures with ISE application health events to identify service outages triggered by network input.
- Baseline RADIUS request rates and alert on deviations that coincide with ISE node degradation.
Monitoring Recommendations
- Forward ISE application, system, and RADIUS logs to a centralized SIEM for correlation with network telemetry.
- Monitor ISE process health, RADIUS response latency, and node availability using Cisco-supported management tools.
- Track ingress RADIUS traffic on ISE interfaces via NetFlow or firewall logs to detect requests from non-approved sources.
How to Mitigate CVE-2026-20352
Immediate Actions Required
- Apply the fixed Cisco ISE software release identified in the Cisco Security Advisory as soon as maintenance windows allow.
- Restrict UDP/1812 and UDP/1813 access on ISE nodes to authorized NAD source addresses using ACLs on upstream firewalls or switches.
- Deploy ISE in a distributed configuration with multiple Policy Service Nodes (PSNs) to remove single points of failure.
- Review RADIUS shared secrets and NAD inventories to confirm only expected devices communicate with ISE.
Patch Information
Cisco has published fixed software details in the security advisory. Administrators should consult the Cisco Security Advisory: RADIUS DoS for affected versions, first-fixed releases, and upgrade guidance specific to their deployment.
Workarounds
- Cisco has not published a specific configuration workaround in the referenced advisory; treat network-layer filtering as a compensating control, not a substitute for patching.
- Limit RADIUS reachability to trusted management and NAD networks using infrastructure ACLs or firewall policy.
- Enable proactive monitoring so operations teams can restart or fail over ISE nodes quickly if an outage occurs.
# Example ACL concept: restrict RADIUS to authorized NAD subnet only
# Apply on upstream firewall or L3 switch protecting the ISE PSN interface
access-list ISE_RADIUS permit udp 10.10.20.0 0.0.0.255 host 10.50.0.10 eq 1812
access-list ISE_RADIUS permit udp 10.10.20.0 0.0.0.255 host 10.50.0.10 eq 1813
access-list ISE_RADIUS deny udp any host 10.50.0.10 eq 1812
access-list ISE_RADIUS deny udp any host 10.50.0.10 eq 1813
access-list ISE_RADIUS permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
