Critical Vulnerabilities in Cisco ISE and Webex Services
Summary
The Cyber Security Agency of Singapore issued an alert advising users and administrators to immediately update Cisco Identity Services Engine (ISE) and Webex Services to address multiple critical security vulnerabilities. Affected CVEs include CVE-2026-20147, CVE-2026-20180, CVE-2026-20186 (CVSSv3.1: 9.9) in Cisco ISE, and CVE-2026-20184 (CVSSv3.1: 9.8) in Webex Services. The vulnerabilities could allow authenticated remote attackers to gain root access and execute arbitrary commands, or unauthenticated attackers to impersonate users and access legitimate Webex services.
What changed
CSA issued an alert reporting multiple critical security vulnerabilities in Cisco ISE versions 3.5 and below and Cisco Webex Services using SSO integration with Control Hub. Three CVEs in ISE (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) with CVSSv3.1 scores of 9.9 enable authenticated remote attackers with valid administrative or read-only admin credentials to achieve remote code execution or execute arbitrary OS commands via crafted HTTP requests. CVE-2026-20184 (CVSSv3.1: 9.8) in Webex allows unauthenticated remote attackers to impersonate any user within the service.
Organizations running Cisco ISE or Webex Services with SSO integration should prioritize patching to the latest versions immediately. Successful exploitation could result in complete system compromise or unauthorized access to collaboration tools. Security teams should verify their deployment versions against the affected ranges and apply Cisco's security updates as soon as possible.
What to do next
- Update to the latest versions immediately
Archived snapshot
Apr 17, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Alerts
Critical Vulnerabilities in Cisco ISE and Webex Services
17 April 2026
Cisco has released security updates to address multiple security vulnerabilities in two of its products: Identity Services Engine (ISE) and Webex Services. There are no indications that these vulnerabilities are being exploited in the wild when this alert is reported. However,successful exploitation of these vulnerabilities may result in gaining root access and remote code execution. Users and administrators of affected products are advised to update to the latest versions immediately.
Background
Cisco has released security updates to address multiple security vulnerabilities in two of its products: Identity Services Engine (ISE) (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) and Webex Services (CVE-2026-20184). These vulnerabilities are caused by two main issues: insufficient validation of user input in ISE systems, and improper certificate validation in Webex Services' single sign-on (SSO) integration with Control Hub.
Impact
Successful exploitation of the vulnerabilities could allow:
CVE-2026-20147 (CVSSv3.1: 9.9): An authenticated remote attacker in possession of valid administrative credentials to achieve remote code execution by sending crafted Hypertext Transfer Protocol (HTTP) requests.
CVE-2026-20180 and CVE-2026-20186 (CVSSv3.1: 9.9): An authenticated remote attacker in possession of read only admin credentials to execute arbitrary commands on the underlying operating system of an affected device by sending crafted HTTP requests.
CVE-2026-20184 (CVSSv3.1: 9.8): An unauthenticated remote attacker to impersonate any user within the service and gain unauthorised access to legitimate Cisco Webex services.
Affected Products
The following product versions are affected by the vulnerabilities.
For CVE-2026-20147:
All Cisco ISE versions 3.5 and below
For CVE-2026-20180 and CVE-2026-20186:All Cisco ISE versions 3.4 and below
For CVE-2026-20184:All Cisco Webex Services using SSO integration with Control Hub
Recommendation
Users and administrators of affected products are advised to update to the latest versions immediately. For additional details and guidance, please refer to Cisco’s official advisories.
References
https://thehackernews.com/2026/04/cisco-patches-four-critical-identity.html
https://nvd.nist.gov/vuln/detail/CVE-2026-20147
https://nvd.nist.gov/vuln/detail/CVE-2026-20180
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.