CVE-2026-20307: Cisco Identity Services Engine Insecure Java Deserialization RCE

HERMES

HERMES THREAT SCORE & HOST APPLIANCE ROOT COMPROMISE

Target: Cisco Identity Services Engine (ISE) — Admin Portal & ObjectInputStream Deserializer

Confidence: 96%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 18 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 9.9 and HTS 94. While the vulnerability requires low-level administrative authentication (PR:L), it forms an immediate attack chain with CVE-2026-20192 (auth bypass), converting pre-authentication access into unconstrained root command execution on the underlying Linux OS host.

HASS

HASS AGENTIC SEVERITY & OS ESCALATION BOUNDARY

Target: Cisco ISE Linux Appliance Kernel & Java Process Subsystem

Confidence: 95%

89 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 18 / 20

Tool Access 19 / 20

Privilege 20 / 15

Persistence 19 / 15

External Impact 19 / 15

Propagation 19 / 15

⚖️ Divergence & Operational Rationale

Executing code as root on Cisco ISE provides raw filesystem access, exposing cryptographic keys used for RADIUS shared secrets, client certificates, and corporate network directory replication.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-20307: Cisco Identity Services Engine Insecure Java Deserialization RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCisco Identity Services Engine (ISE)

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Identity Services Engine (ISE) documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Cisco Security Advisory: September 16, 2026

CVSS v3.1: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) / CWE-502: Deserialization of Untrusted Data. Disclosed in the Cisco Security Advisory on September 16, 2026. Addressed in Cisco ISE 3.2 Patch 7, 3.3 Patch 3, and 3.4 Patch 1.

Executive Summary

CVE-2026-20307 is a critical vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). An authenticated administrator with low privileges can transmit crafted serialized Java objects to the appliance. The application fails to validate the structure and classes of incoming serialized streams before invoking readObject(), triggering gadget chain execution that grants operating system command execution with root privileges.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-20307	Cisco Advisory cisco-sa-ise-rce-2026
Vulnerability Class	Insecure Deserialization (CWE-502)	Arbitrary Java gadget chain invocation
Affected Component	Web Management Session & Backup Handler	Port TCP 443 (Web Management Interface)
Authentication Required	Low Privilege (PR:L)	Any valid admin role (or chained with CVE-2026-20192)
User Interaction	None (UI:N)	Instant synchronous execution
Scope Impact	Changed (S:C)	Complete host Linux OS takeover as root
Affected Versions	ISE 3.1, 3.2 (< Patch 7), 3.3 (< Patch 3), 3.4 (< Patch 1)	Production Cisco ISE deployments
Remediation Target	Cisco September 2026 Maintenance Releases	Patch 7 (3.2), Patch 3 (3.3), Patch 1 (3.4)

---

2. Vulnerability Anatomy & Gadget Execution

The flaw occurs in the administrative portal during the processing of session backup and diagnostic package imports:

graph TD
    Payload["Serialized Object Upload"] --> Stream["ObjectInputStream.readObject()"]
    Stream --> Gadget["Common Collections / Spring Gadget Chain"]
    Gadget --> Exec["Runtime.getRuntime().exec()"]
    Exec --> Root["Root Shell Command Execution"]

Because the application lacked an ObjectInputFilter whitelist, incoming byte streams containing known gadget chains (such as Commons Collections or internal Cisco utility classes) execute arbitrary OS commands when deserialized by the Java runtime running as root.

---

3. Attack Vector & Chaining with CVE-2026-20192

sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant API as Cisco ISE REST Gateway
    participant Portal as Web Admin Portal
    participant OS as Underlying Linux OS (Root)

    Note over Attacker,API: Phase 1: Authentication Bypass (CVE-2026-20192)
    Attacker->>API: Forged header REST request creates temporary admin user
    API-->>Attacker: Administrative session established

    Note over Attacker,Portal: Phase 2: Deserialization RCE (CVE-2026-20307)
    Attacker->>Portal: POST /admin/diagnosticImport with serialized payload
    Portal->>Portal: Unvalidated ObjectInputStream deserialization
    Portal->>OS: Spawn root bash process / reverse shell
    OS-->>Attacker: Interactive Root Shell on ISE Appliance

---

4. Detection Engineering & Threat Hunting

Sigma Rule (ISE Deserialization Exploit)

title: Cisco ISE Java Deserialization Exploit Attempt
id: cve-2026-20307-ise-deserialization
status: production
description: Detects serialized Java magic bytes (0xACED0005) uploaded to Cisco ISE web portal endpoints.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-2026
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: webserver
  product: cisco_ise
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/admin/'
      - '/diagnostic'
    cs-bytes|startswith: 'rO0AB' # Base64 for 0xaced0005
  condition: selection
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505

---

5. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Apply Vendor Patch: Install Cisco ISE 3.2 Patch 7, 3.3 Patch 3, or 3.4 Patch 1.
2. T0 Mitigation — Isolate Management Port: Enforce network segmentation ensuring the web management interface on TCP 443 is accessible only via secure jump boxes.
3. T1 Tactical Audit (< 7d) — Perform Process Lineage Verification: Check for unauthorized child processes spawned by the ISE Java daemon:

   pstree -p $(pgrep -f "ise-server")

---

6. Related Intelligence & Attack Paths

Cisco Identity Services Engine Intelligence Track vulnerabilities, patch lifecycle, and network policy security for Cisco ISE.

Cisco ISE Auth Bypass (CVE-2026-20192) Analyze the companion pre-auth vulnerability often chained with CVE-2026-20307.

Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.