Cisco Patches Critical Vulnerabilities in Webex, ISE
The flaws can be exploited remotely to impersonate users or execute arbitrary commands on the underlying OS.
Aggregated from SecurityWeek
This article was automatically aggregated from an external source. Content may be summarized.
Full Analysis
Cisco on Wednesday announced patches for 15 vulnerabilities, including critical-severity flaws in Webex and Identity Services Engine (ISE).
Tracked as CVE-2026-20184, the critical Webex bug impacts the single sign-on (SSO) integration with Control Hub and could allow remote, unauthenticated attackers to impersonate any user, Cisco says.
An improper certificate validation could have allowed attackers to connect to a service endpoint and supply a crafted token to access legitimate Webex services without authorization.
While the company has addressed the issue in Webex Services, which are cloud-based, customers using SSO “should upload a new identity provider (IdP) SAML certificate to Control Hub,” Cisco explains.
On Wednesday, the company fixed three critical security defects in ISE, two of which – CVE-2026-20180 and CVE-2026-20186 – could allow remote, authenticated attackers that have read-only admin rights to execute arbitrary commands on the underlying OS.
The two vulnerabilities exist because user-supplied input is insufficiently validated, allowing attackers to obtain user-level access to the underlying OS via crafted HTTP requests and then elevate their privileges to root.
Advertisement. Scroll to continue reading.
In single-node Cisco ISE deployments, the bugs could be exploited to cause denial-of-service (DoS) conditions, preventing unauthenticated endpoints from accessing the network.
The third critical ISE flaw, CVE-2026-20147, allows remote, authenticated attackers with admin privileges to execute arbitrary commands on the underlying OS, and can be exploited in the same way as the other two issues.
The remaining 11 security defects that Cisco patched on Wednesday are medium-severity weaknesses leading to path traversal attacks, XSS attacks, authentication policy bypass, file leaks, file overwrite, and command injection attacks.
Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page.
Related: Two Vulnerabilities Patched in Ivanti Neurons for ITSM
Related: Fortinet Patches Critical FortiSandbox Vulnerabilities
Related: Cisco Patches Critical and High-Severity Vulnerabilities
Related: Cisco Patches Multiple Vulnerabilities in IOS Software
Originally published by SecurityWeek
Original Source
SecurityWeek