IS
Product
Identity Services Engine
On CISA KEVExploited in the wild
197
CVEs
3
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 14High 39Medium 133Low 2
Watch
Add Identity Services Engine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-20194 | 4.9 | Sep 7 | A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device Affected: through 2.7; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +13 more |
| CVE-2023-20174 | 4.9 | May 18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or… Affected: before 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +11 more |
| CVE-2023-20173 | 4.9 | May 18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or… Affected: before 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +11 more |
| CVE-2023-20172 | 4.9 | May 18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system Affected: 3.1; 3.1; 3.1; 3.1; 3.1; 3.2; +1 more |
| CVE-2023-20167 | 4.9 | May 18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to… Affected: before 3.1; 3.1; 3.1; 3.1; 3.1; 3.1; +3 more |
| CVE-2022-20914 | 4.9 | Aug 10 | Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability Affected: 2.4.0 before 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +21 more |
| CVE-2018-15456 | 4.9 | Jan 10 | A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text Affected: 2.2(0.470); 2.3(0.298); 2.4(0.357); 2.4(100.159) |
| CVE-2026-20132 | 4.8 | Apr 15 | Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities Affected: before 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +10 more |
| CVE-2026-20076 | 4.8 | Jan 15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: through 3.1.0; 3.2; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +9 more |
| CVE-2026-20047 | 4.8 | Jan 15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated,… Affected: before 3.2; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +16 more |
| CVE-2025-20267 | 4.8 | May 21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS)… Affected: before 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +9 more |
| CVE-2025-20205 | 4.8 | Feb 5 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attacker to conduct… Affected: 3.0.0 before 3.2; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +7 more |
| CVE-2025-20204 | 4.8 | Feb 5 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attacker to conduct… Affected: 3.0.0 before 3.2; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +7 more |
| CVE-2024-20539 | 4.8 | Nov 6 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +22 more |
| CVE-2024-20479 | 4.8 | Aug 7 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.0; +32 more |
| CVE-2023-20208 | 4.8 | Nov 21 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +9 more |
| CVE-2021-40121 | 4.8 | Oct 21 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS)… Affected: through 2.6; 2.6(0.156); 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; +20 more |
| CVE-2021-34759 | 4.8 | Sep 2 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative… Affected: before 2.2.0; 2.2.0; 2.2.0; 2.2.0; 2.2.0; 2.2.0; +34 more |
| CVE-2021-1607 | 4.8 | Jul 8 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.6.0; 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; 2.6.0; +11 more |
| CVE-2021-1606 | 4.8 | Jul 8 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.6.0; 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; 2.6.0; +11 more |
| CVE-2021-1605 | 4.8 | Jul 8 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.6.0; 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; 2.6.0; +11 more |
| CVE-2021-1604 | 4.8 | Jul 8 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.6.0; 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; 2.6.0; +11 more |
| CVE-2021-1603 | 4.8 | Jul 8 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.6.0; 2.6(0.999); 2.6.0; 2.6.0; 2.6.0; 2.6.0; +11 more |
| CVE-2020-26083 | 4.8 | Nov 6 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to… Affected: All versions, or not specified |
| CVE-2020-3589 | 4.8 | Oct 8 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative… Affected: 2.2.0; 2.2.0.470; 2.2.0.470; 2.2.0.470; 2.2.0.470; 2.2.0.470; +34 more |
| CVE-2020-3340 | 4.8 | Jul 2 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative… Affected: before 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +1 more |
| CVE-2020-3149 | 4.8 | Feb 5 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site… Affected: before 2.7 |
| CVE-2018-15425 | 4.7 | Oct 5 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the… Affected: 2.1(0.474); 2.1(0.907); 2.2(0.470); 2.2(0.909); 2.3(0.298); 2.3(0.905); +2 more |
| CVE-2018-15424 | 4.7 | Oct 5 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the… Affected: 2.2(0.470) |
| CVE-2018-0211 | 4.4 | Mar 8 | A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition Affected: 2.1(0.474); 2.2(1.145); 2.4(0.247) |
| CVE-2026-20193 | 4.3 | May 6 | Cisco Identity Services Engine Authentication Bypass Vulnerability Affected: through 3.2.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +15 more |
| CVE-2020-3525 | 4.3 | Nov 18 | A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to recover service account passwords that are saved… Affected: 002.002(000.916); 002.003(000.906); 002.004(000.911); 002.006(000.902) |
| CVE-2023-20213 | 4.3 | Nov 1 | A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of the CDP process on an… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.0; +19 more |
| CVE-2021-34702 | 4.3 | Oct 6 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information Affected: 2.2.0 before 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +14 more |
| CVE-2021-1416 | 4.3 | Feb 17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information Affected: before 2.3.0; 2.3.0; 2.3.0; 2.3.0; 2.3.0; 2.3.0; +29 more |
| CVE-2025-20285 | 4.1 | Jul 16 | A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and… Affected: before 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +4 more |
| CVE-2023-20106 | 3.8 | May 18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system Affected: 3.1; 3.1; 3.1; 3.1; 3.1; 3.2; +1 more |
| CVE-2021-1306 | 3.4 | May 22 | A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an… Affected: before 2.7.0; 2.7.0; 2.7.0; 3.0.0; 3.0.0 |
| CVE-2014-0680 | – | Jan 29 | Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject… Affected: All versions, or not specified |
| CVE-2013-5541 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in the file-upload interface in Cisco Identity Services Engine (ISE) allows remote authenticated users to inject arbitrary web script or… Affected: All versions, or not specified |
| CVE-2013-5540 | – | Oct 16 | The file-upload feature in Cisco Identity Services Engine (ISE) allows remote authenticated users to cause a denial of service (disk consumption and administration-interface… Affected: All versions, or not specified |
| CVE-2013-5539 | – | Oct 16 | The upload-dialog implementation in Cisco Identity Services Engine (ISE) allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct… Affected: All versions, or not specified |
| CVE-2013-5538 | – | Oct 16 | The Sponsor Portal in Cisco Identity Services Engine (ISE) uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request,… Affected: All versions, or not specified |
| CVE-2013-3445 | – | Jul 29 | The firewall subsystem in Cisco Identity Services Engine has an incorrect rule for open ports, which allows remote attackers to cause a denial of service (CPU consumption or… Affected: All versions, or not specified |
| CVE-2013-3420 | – | Jul 18 | Cross-site request forgery (CSRF) vulnerability in the web framework on the Cisco Identity Services Engine (ISE) allows remote attackers to hijack the authentication of arbitrary… Affected: All versions, or not specified |
| CVE-2012-3908 | – | Sep 16 | Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300… Affected: 3300 |
| CVE-2011-3290 | – | Sep 21 | Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other… Affected: All versions, or not specified |