Cisco Patches Four Critical Flaws in Identity Services Engine and Webex, Including a 9.8-Severity SSO Bypass
Cisco discloses four critical vulnerabilities across ISE and Webex, with the most severe allowing unauthenticated attackers to impersonate any user via a broken SSO certificate check.
Overview
Cisco released three critical security advisories on April 15, 2026, disclosing four vulnerabilities that affect two widely deployed enterprise products: the Webex collaboration platform and Identity Services Engine (ISE), the company’s flagship network access control system. The most severe flaw, CVE-2026-20184, carries a CVSS score of 9.8 and allows an unauthenticated remote attacker to impersonate any user on a Webex deployment configured with single sign-on. Three additional ISE vulnerabilities, all rated 9.9, enable authenticated attackers to escalate privileges to root-level command execution, according to CSO Online.
Cisco’s Product Security Incident Response Team (PSIRT) said it has found no evidence of active exploitation of any of the four flaws.
Webex SSO Bypass: CVE-2026-20184
The highest-profile vulnerability is an improper certificate validation flaw (CWE-295) in Webex’s integration with Control Hub for single sign-on authentication. The weakness means Webex failed to properly verify identity provider (IdP) certificates on incoming SAML authentication requests, as reported by CSO Online. An attacker can exploit the flaw by supplying a crafted authentication token to a vulnerable endpoint; if accepted, the attacker gains full access to a legitimate user’s Webex account without needing credentials.
Cisco has already patched the cloud-side service, but administrators must complete the remediation by uploading a new SAML certificate for their identity provider to the Webex Control Hub. No workaround exists, and organizations that fail to rotate the certificate remain exposed to impersonation attacks. The vulnerability was discovered during Cisco’s own internal security testing, according to The Hacker News.
ISE Command Injection Flaws: CVE-2026-20147, CVE-2026-20180, CVE-2026-20186
The remaining three critical vulnerabilities affect Cisco Identity Services Engine, the company’s network access control platform used by enterprises to enforce role-based access policies across wired, wireless, and VPN connections.
CVE-2026-20147, rated CVSS 9.9, stems from insufficient validation of user-supplied input in ISE and ISE Passive Identity Connector (ISE-PIC). An authenticated attacker with valid administrative credentials can send crafted HTTP requests to achieve remote code execution, gaining user-level access to the underlying operating system with the ability to escalate to root, as detailed by The Hacker News. On single-node deployments, exploitation can also cause a denial-of-service condition.
CVE-2026-20180 and CVE-2026-20186, both also rated 9.9, are separate input validation flaws that lower the bar further: an attacker needs only read-only administrative credentials to execute arbitrary commands on the host operating system, according to CSO Online. Jonathan Lein of TrendAI Research is credited with discovering the ISE vulnerabilities.
Patch Matrix
No workarounds are available for any of the ISE flaws. Cisco’s required upgrade path for each supported release is:
- ISE 3.1: Patch 11
- ISE 3.2: Patch 10
- ISE 3.3: Patch 11
- ISE 3.4: Patch 6
- ISE 3.5: Patch 3
Organizations running ISE versions older than 3.1 must migrate to a supported release. ISE-PIC 3.4 is the final supported version of that component.
What We Don’t Know
Cisco has not disclosed how many organizations use SSO-integrated Webex deployments or ISE instances that remain unpatched. The ISE vulnerabilities require some form of administrative access, which narrows the threat surface, but compromised admin credentials remain one of the most common vectors in enterprise breaches. Whether the SAML certificate rotation requirement will cause disruption for large Webex deployments during the remediation window is also unclear.
Gartner analyst Peter Firstbrook told CSO Online that “identity and access management is the corporate perimeter,” noting the disclosures underscore how identity compromise remains central to modern intrusions.