{
    "document": {
        "category": "csaf_security_advisory",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "nl",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            },
            {
                "category": "description",
                "text": "Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC).",
                "title": "Feiten"
            },
            {
                "category": "description",
                "text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Cisco ISE en ISE-PIC, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 21 kwetsbaarheden zijn 13 als kritiek aangemerkt. Op basis van de door Cisco gepubliceerde CVSS-scores kunnen vier kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het omzeilen van authenticatie- en autorisatiecontroles, het verkrijgen en wijzigen van gevoelige configuratie- en identiteitsgegevens, het uitvoeren van willekeurige code of commando's met rootrechten, SQL-injectie, het uitlezen van bestanden en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen voorafgaande administratieve toegangsrechten of een specifieke configuratie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nVan de 13 kwetsbaarheden die als kritiek zijn aangemerkt, hebben meerdere een CVSS-score van 9,8 of hoger. Vier kwetsbaarheden, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 en CVE-2026-76460, hebben een CVSS-score van 10,0. \n\nDe kwetsbaarheid met kenmerk CVE-2026-76423 betreft een kwetsbaarheid in de REST API waarmee een niet-geauthenticeerde kwaadwillende administratieve toegang kan verkrijgen tot Cisco ISE en ISE-PIC. \n\nDe kwetsbaarheid met kenmerk CVE-2026-76460 betreft een authenticatieomzeiling in een API van Cisco ISE en ISE-PIC waarmee een niet-geauthenticeerde kwaadwillende toegang tot het getroffen systeem kan verkrijgen. Cisco meldt dat deze kwetsbaarheid actief wordt misbruikt. Na succesvolle exploitatie kunnen kwaadwillenden volgens Cisco commando's met rootrechten uitvoeren. \n\nDe kwetsbaarheden met kenmerk CVE-2026-20130 en CVE-2026-20192 betreffen door Cisco gegroepeerde kwetsbaarheden op het gebied van respectievelijk onvoldoende neutralisatie van invoer en onjuiste toegangscontrole. Cisco heeft voor deze hardening-release meerdere onderliggende kwetsbaarheden per CWE-klasse onder één CVE-ID samengebracht. De CVSS-score vertegenwoordigt daarbij de hoogst scorende onderliggende kwetsbaarheid.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.",
                "title": "Interpretaties"
            },
            {
                "category": "description",
                "text": "Cisco heeft updates uitgebracht voor Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC) om de kwetsbaarheden te verhelpen.\n\nCisco heeft voor de kwetsbaarheid met kenmerk CVE-2026-76460 een IoC opgenomen in de betreffende advisory. Omdat een kwaadwillende na succesvolle exploitatie rootrechten kan verkrijgen en sporen van misbruik kan verwijderen of verbergen, adviseert Cisco ook externe netwerk- en firewalllogs te controleren. Wanneer aanwijzingen voor misbruik worden aangetroffen, adviseert Cisco om de getroffen nodes opnieuw te installeren en indien nodig de configuratie vanuit een back-up te herstellen. Zie bijgevoegde advisory voor meer informatie.\n\nVoor de kwetsbaarheden met kenmerk CVE-2026-20130 en CVE-2026-20192 heeft Cisco daarnaast software-hardeningupdates uitgebracht. Raadpleeg de bijgevoegde advisories voor meer informatie.",
                "title": "Oplossingen"
            },
            {
                "category": "general",
                "text": "high",
                "title": "Kans"
            },
            {
                "category": "general",
                "text": "high",
                "title": "Schade"
            },
            {
                "category": "general",
                "text": "Relative Path Traversal",
                "title": "CWE-23"
            },
            {
                "category": "general",
                "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
                "title": "CWE-77"
            },
            {
                "category": "general",
                "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                "title": "CWE-78"
            },
            {
                "category": "general",
                "text": "Authentication Bypass by Spoofing",
                "title": "CWE-290"
            },
            {
                "category": "general",
                "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                "title": "CWE-89"
            },
            {
                "category": "general",
                "text": "Deserialization of Untrusted Data",
                "title": "CWE-502"
            },
            {
                "category": "general",
                "text": "Insufficiently Protected Credentials",
                "title": "CWE-522"
            },
            {
                "category": "general",
                "text": "Improper Restriction of Names for Files and Other Resources",
                "title": "CWE-641"
            },
            {
                "category": "general",
                "text": "Improper Restriction of XML External Entity Reference",
                "title": "CWE-611"
            },
            {
                "category": "general",
                "text": "Incorrect Resource Transfer Between Spheres",
                "title": "CWE-669"
            },
            {
                "category": "general",
                "text": "Improper Neutralization of Special Elements in Data Query Logic",
                "title": "CWE-943"
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "Nationaal Cyber Security Centrum",
            "namespace": "https://www.ncsc.nl/"
        },
        "references": [
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5"
            },
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"
            },
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-e2CuZCYZ"
            },
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc"
            },
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ"
            },
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57"
            }
        ],
        "title": "Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)",
        "tracking": {
            "current_release_date": "2026-09-17T09:24:38.495978Z",
            "generator": {
                "date": "2025-08-04T16:30:00Z",
                "engine": {
                    "name": "V.A.",
                    "version": "1.3"
                }
            },
            "id": "NCSC-2026-0382",
            "initial_release_date": "2026-09-17T09:24:38.495978Z",
            "revision_history": [
                {
                    "date": "2026-09-17T09:24:38.495978Z",
                    "number": "1.0.0",
                    "summary": "Initiele versie"
                }
            ],
            "status": "final",
            "version": "1.0.0"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/*",
                                "product": {
                                    "name": "vers:unknown/*",
                                    "product_id": "CSAFPID-1"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Cisco ISE Passive Identity Connector"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/*",
                                "product": {
                                    "name": "vers:unknown/*",
                                    "product_id": "CSAFPID-2"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Cisco Identity Services Engine Software"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/*",
                                "product": {
                                    "name": "vers:unknown/*",
                                    "product_id": "CSAFPID-3"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "identity_services_engine"
                    }
                ],
                "category": "vendor",
                "name": "Cisco"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-20307",
            "cwe": {
                "id": "CWE-502",
                "name": "Deserialization of Untrusted Data"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Deserialization of Untrusted Data",
                    "title": "CWE-502"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
                    "title": "CWE-77"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow authenticated attackers with low-privileged admin credentials to execute arbitrary code and commands via insecure deserialization, potentially causing denial of service in single-node deployments.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20307 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20307.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.9,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20307"
        },
        {
            "cve": "CVE-2026-20211",
            "cwe": {
                "id": "CWE-502",
                "name": "Deserialization of Untrusted Data"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Deserialization of Untrusted Data",
                    "title": "CWE-502"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
                    "title": "CWE-77"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow authenticated attackers with administrative privileges to execute arbitrary commands on the underlying OS, including potential root access or denial-of-service in single-node setups.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20211 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20211.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20211"
        },
        {
            "cve": "CVE-2026-20176",
            "cwe": {
                "id": "CWE-502",
                "name": "Deserialization of Untrusted Data"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Deserialization of Untrusted Data",
                    "title": "CWE-502"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
                    "title": "CWE-77"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow authenticated attackers with administrative credentials to execute arbitrary operating system commands, potentially leading to system-level access, privilege escalation, and denial of service.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20176 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20176.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20176"
        },
        {
            "cve": "CVE-2026-76423",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow remote attackers to bypass authentication, execute remote code, and perform SQL injection and XML External Entity injection attacks via REST API authorization flaws.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76423 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76423.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
                        "baseScore": 10.0,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76423"
        },
        {
            "cve": "CVE-2026-76424",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) enable remote attackers to bypass REST API authentication, execute remote code, and perform SQL injection and XML External Entity injection attacks.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76424 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76424.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.2,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76424"
        },
        {
            "cve": "CVE-2026-76425",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) enable remote attackers to bypass REST API authentication, execute remote code, and perform SQL injection, SSRF, and XML External Entity injection attacks.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76425 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76425.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
                        "baseScore": 7.6,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76425"
        },
        {
            "cve": "CVE-2026-76426",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) enable remote attackers to bypass REST API authentication, execute remote code, and perform SQL injection and XML External Entity injection attacks.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76426 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76426.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 4.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76426"
        },
        {
            "cve": "CVE-2026-76427",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) enable remote attackers to bypass REST API authentication, execute remote code, perform SQL injection, and exploit XML External Entity injection, including arbitrary file reading via offline profiler feed service.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76427 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76427.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 4.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76427"
        },
        {
            "cve": "CVE-2026-76428",
            "cwe": {
                "id": "CWE-23",
                "name": "Relative Path Traversal"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Relative Path Traversal",
                    "title": "CWE-23"
                },
                {
                    "category": "other",
                    "text": "Authentication Bypass by Spoofing",
                    "title": "CWE-290"
                },
                {
                    "category": "other",
                    "text": "Improper Restriction of XML External Entity Reference",
                    "title": "CWE-611"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                    "title": "CWE-89"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) enable remote attackers to bypass REST API authentication, execute remote code, and perform SQL injection and XML External Entity injection attacks.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76428 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76428.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 4.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76428"
        },
        {
            "cve": "CVE-2026-20282",
            "cwe": {
                "id": "CWE-641",
                "name": "Improper Restriction of Names for Files and Other Resources"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Improper Restriction of Names for Files and Other Resources",
                    "title": "CWE-641"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                    "title": "CWE-78"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements in Data Query Logic",
                    "title": "CWE-943"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow authenticated remote attackers with administrative credentials to perform SQL injection, modify data, and execute arbitrary OS commands via crafted HTTP requests.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20282 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20282.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
                        "baseScore": 4.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20282"
        },
        {
            "cve": "CVE-2026-20283",
            "cwe": {
                "id": "CWE-641",
                "name": "Improper Restriction of Names for Files and Other Resources"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Improper Restriction of Names for Files and Other Resources",
                    "title": "CWE-641"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                    "title": "CWE-78"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements in Data Query Logic",
                    "title": "CWE-943"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE), including SQL injection and command injection via the IPsec Open API endpoint, allow authenticated remote attackers with valid credentials to execute arbitrary commands and potentially gain root access.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20283 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20283.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                        "baseScore": 6.5,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20283"
        },
        {
            "cve": "CVE-2026-20284",
            "cwe": {
                "id": "CWE-641",
                "name": "Improper Restriction of Names for Files and Other Resources"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Improper Restriction of Names for Files and Other Resources",
                    "title": "CWE-641"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                    "title": "CWE-78"
                },
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements in Data Query Logic",
                    "title": "CWE-943"
                },
                {
                    "category": "description",
                    "text": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE), including SQL injection flaws in the SXP REST API, allow authenticated remote attackers to modify data, execute arbitrary OS commands, or cause denial of service.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20284 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20284.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20284"
        },
        {
            "cve": "CVE-2026-20305",
            "cwe": {
                "id": "CWE-78",
                "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                    "title": "CWE-78"
                },
                {
                    "category": "description",
                    "text": "Multiple command injection vulnerabilities in Cisco ISE and ISE-PIC diagnostic tools allow authenticated remote attackers with administrative credentials to execute arbitrary code and escalate privileges to root, potentially causing denial of service.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20305 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20305.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20305"
        },
        {
            "cve": "CVE-2026-20306",
            "cwe": {
                "id": "CWE-78",
                "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                    "title": "CWE-78"
                },
                {
                    "category": "description",
                    "text": "Multiple command injection vulnerabilities in Cisco ISE and ISE-PIC REST API allow authenticated administrators to execute arbitrary code with root privileges, potentially causing denial-of-service in single-node deployments.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20306 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20306.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20306"
        },
        {
            "cve": "CVE-2026-20130",
            "notes": [
                {
                    "category": "description",
                    "text": "Cisco released a software hardening update for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to fix multiple vulnerabilities involving improper neutralization of special elements, identified as CVE-2026-20130 and CWE-74.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20130 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20130.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 10.0,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20130"
        },
        {
            "cve": "CVE-2026-20192",
            "notes": [
                {
                    "category": "description",
                    "text": "Cisco has released a software hardening update for its Identity Services Engine (ISE) and ISE Passive Identity Connector to address multiple improper access control vulnerabilities identified as CVE-2026-20192 under CWE-284.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20192 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20192.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 10.0,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20192"
        },
        {
            "cve": "CVE-2026-20194",
            "cwe": {
                "id": "CWE-669",
                "name": "Incorrect Resource Transfer Between Spheres"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Incorrect Resource Transfer Between Spheres",
                    "title": "CWE-669"
                },
                {
                    "category": "description",
                    "text": "Cisco has issued a software hardening update for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to fix multiple internally discovered vulnerabilities related to incorrect resource transfer, tracked as CVE-2026-20194 and classified under CWE-669.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20194 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20194.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20194"
        },
        {
            "cve": "CVE-2026-20234",
            "cwe": {
                "id": "CWE-522",
                "name": "Insufficiently Protected Credentials"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Insufficiently Protected Credentials",
                    "title": "CWE-522"
                },
                {
                    "category": "description",
                    "text": "Cisco's Identity Services Engine (ISE) and Passive Identity Connector teams released a software update addressing multiple credential protection vulnerabilities identified as CVE-2026-20234 under CWE-522.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20234 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20234.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.9,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20234"
        },
        {
            "cve": "CVE-2026-20237",
            "notes": [
                {
                    "category": "description",
                    "text": "Cisco released a software hardening update for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address multiple internally discovered input validation vulnerabilities, including CVE-2026-20237 and CWE-20.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20237 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20237.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20237"
        },
        {
            "cve": "CVE-2026-20287",
            "notes": [
                {
                    "category": "description",
                    "text": "Cisco has released a software hardening update for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) addressing multiple privilege management vulnerabilities identified as CVE-2026-20287 and CWE-269.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-20287 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20287.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                        "baseScore": 6.5,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-20287"
        },
        {
            "cve": "CVE-2026-76460",
            "cwe": {
                "id": "CWE-648",
                "name": "Incorrect Use of Privileged APIs"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Incorrect Use of Privileged APIs",
                    "title": "CWE-648"
                },
                {
                    "category": "description",
                    "text": "A vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector APIs allows unauthenticated remote attackers to bypass authentication and gain unauthorized access via crafted requests to privileged API endpoints.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1",
                    "CSAFPID-2",
                    "CSAFPID-3"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-76460 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76460.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 10.0,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1",
                        "CSAFPID-2",
                        "CSAFPID-3"
                    ]
                }
            ],
            "title": "CVE-2026-76460"
        }
    ]
}