InfoSecBulletin Cybersecurity for mankind
Cisco has updated to fix four security issues affecting Identity Services and Webex Services. These flaws could let someone run harmful code and pretend to be any user in the service.
The details of the vulnerabilities are below:
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
CVE-2026-20184 (CVSS score: 9.8): An improper check of certificates in the single sign-on (SSO) system with Control Hub in Webex Services may let a remote attacker who is not signed in pretend to be any user and get unauthorized access to genuine Cisco Webex services.
CVE-2026-20147 (CVSS score: 9.9): An issue with checking user input in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) could let a remote attacker with valid admin credentials run harmful code by sending specially made HTTP requests.
CVE-2026-20180 and CVE-2026-20186 (CVSS scores: 9.9): Multiple insufficient validation of user-supplied input vulnerabilities in ISE could allow an authenticated, remote attacker in possession of read only admin credentials to execute arbitrary commands on the underlying operating system of an affected device by sending crafted HTTP requests.
“A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root,” Cisco said in an advisory for CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186.
“In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.”
CVE-2026-20184 does not need any action from customers because it’s cloud-based. But, customers using SSO should upload a new IdP SAML certificate to Control Hub. The other problems have been fixed in these versions –
CVE-2026-20147
Cisco ISE or ISE-PIC Release earlier than 3.1 (Migrate to a fixed release)
Cisco ISE Release 3.1 (3.1 Patch 11)
Cisco ISE Release 3.2 (3.2 Patch 10)
Cisco ISE Release 3.3 (3.3 Patch 11)
Cisco ISE Release 3.4 (3.4 Patch 6)
Cisco ISE Release 3.5 (3.5 Patch 3)
CVE-2026-20180 and CVE-2026-20186
Cisco ISE Release earlier than 3.2 (Migrate to a fixed release)
Cisco ISE Release 3.2 (3.2 Patch 8)
Cisco ISE Release 3.3 (3.3 Patch 8)
Cisco ISE Release 3.4 (3.4 Patch 4)
Cisco ISE Release 3.5 (Not Vulnerable)
Cisco said it has not seen any of these issues being used to attack systems, but users should update to the latest version for better security.
