CVE-2026-20284: SQL Injection in Cisco ISE SXP REST API

Overview

Cisco has disclosed CVE-2026-20284, a critical SQL injection vulnerability in the SXP REST API of Cisco Identity Services Engine (ISE). The flaw stems from insufficient validation of user-supplied input in REST API calls, and could allow an authenticated, remote attacker to send crafted input to the SXP REST API and manipulate the underlying database queries.

The issue carries a CVSS score of 9.1 (Critical) and is one of more than twenty vulnerabilities Cisco addressed in a coordinated September 2026 ISE security update, published as advisory cisco-sa-ise-mult-vul-ymSsTLCc ("Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities") on September 16, 2026.

This CVE is distinct from the separate, more severe Cisco ISE authentication-bypass zero-day (CVE-2026-76460, CVSS 10.0) that Cisco PSIRT has confirmed is being actively exploited in the wild. CVE-2026-20284 is not that vulnerability — it is a lower-likelihood, credential-gated SQL injection issue in a specific ISE subsystem, and, as detailed below, Cisco has not confirmed active exploitation of it.

Technical Details

How It Works

The vulnerability lives in the SXP (SGT Exchange Protocol) REST API exposed by Cisco ISE. SXP is used to propagate Security Group Tag (SGT) bindings between network devices that do not natively support inline tagging, and ISE's REST interface lets administrators manage SXP peer connections programmatically.

According to Cisco's advisory, the API endpoint fails to properly neutralize special characters in user-supplied input before using it to build backend database queries — a classic improper neutralization of special elements in a data query (SQL injection, CWE-89-style) flaw. Because the input reaches the query layer largely unsanitized, an attacker who can reach the API can craft a request whose parameters break out of the intended query structure and inject arbitrary SQL logic.

Exploitation is gated by three conditions, per Cisco: the attacker must hold valid administrative credentials on the ISE node, the SXP service must be enabled, and at least one SXP connection must be configured. This keeps the bar higher than an unauthenticated flaw, but the CVSS vector reflects that once those conditions are met, exploitation requires low attack complexity and no user interaction, and a successful exploit changes the security scope (S:C) — meaning impact extends beyond the vulnerable component itself, to the underlying database. Cisco notes that in single-node deployments, a successful exploit could also crash the ISE process, producing a denial-of-service condition in which endpoints that have not yet authenticated lose network access until the node recovers.

Impact Assessment

Organizations at risk are those running Cisco ISE for network access control (NAC), 802.1X authentication, and policy-based segmentation — which, for most enterprises running ISE, means it sits at the center of who and what is allowed onto the network. Cisco ISE is deployed widely in large enterprise, government, healthcare, and critical-infrastructure environments as the policy decision point for wired, wireless, and VPN access.

Because the flaw allows an attacker to view or modify data on the underlying ISE database, a successful exploit chain could expose:

• Policy and authentication data stored in the ISE database, including authorization rules and device/endpoint records
• Credential material or configuration secrets persisted by ISE for integrations (e.g., directory service bind accounts, RADIUS/TACACS+ shared secrets, certificate references)
• A path to tamper with NAC policy decisions, potentially weakening or bypassing the access controls ISE is meant to enforce
• In single-node deployments, a denial-of-service condition that blocks new endpoint authentication until the node is restored

Because the attacker must already hold valid administrative credentials, this is best understood as a privilege-abuse and lateral-movement risk — most dangerous in combination with a separate credential compromise (phishing, credential reuse, an insider, or another initial-access vulnerability) rather than as a standalone remote entry point. That said, Cisco's own advisory flags related ISE issues in the same September 2026 batch as having a Security Impact Rating raised above their raw CVSS score specifically because low-privilege access can be pivoted to root — a reminder that "requires admin credentials" should not be treated as low risk in ISE's architecture.

Mitigation

• Apply Cisco's fixed release for your ISE version: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, as applicable. Cisco has not published a workaround for this specific CVE — patching is the remediation path. Always confirm current fixed-release guidance on Cisco's official Security Advisories page, as patch trains are periodically superseded.
• Restrict REST API access to trusted management networks only; the ISE administrative and API interfaces should never be reachable from general user network segments or the internet.
• Review and tighten administrative account hygiene — enforce least privilege for ISE admin roles, require multi-factor authentication for administrative access, and audit who holds credentials capable of reaching the SXP REST API.
• Disable the SXP service on ISE nodes where SXP is not actively in use, removing one of the prerequisite conditions for exploitation.
• Monitor API and database logs for anomalous or SQL-like payloads in SXP REST API requests, and for unexpected query errors that could indicate injection attempts.
• Rotate credentials for ISE administrative accounts and any secrets stored in or referenced by the ISE database if compromise is suspected.

References

• NVD — CVE-2026-20284
• Cisco Security Advisory — cisco-sa-ise-mult-vul-ymSsTLCc