SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20130

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score35/100 — MITTEL
  • CVSS 10 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

Erkennung & Indikatoren

Ausnutzung

One of the vulnerabilities addressed in this hardening release is known to be actively exploited. For more information, see Cisco Identity Services Engine Authentication Bypass Vulnerability.

Threat-Hunting-Queries

CVE-2026-20130 relates to improper neutralization of special elements (CWE-74), covering command injection, cross-site scripting, XML injection, code injection, and resource injection. Detection should focus on anomalous process execution, unusual network connections, or unexpected file modifications originating from Cisco ISE or ISE-PIC, indicative of successful injection attacks.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("java.exe", "tomcat.exe", "ise.exe") or FileName in ("cmd.exe", "powershell.exe", "bash", "sh")
| where ProcessCommandLine has_any ("-c", "/c", "-exec", "-command")
| where InitiatingProcessParentFileName == "java.exe" or InitiatingProcessParentFileName == "tomcat.exe"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessCommandLine
| extend IoC_Type = "Behavioral - Command Injection"

Splunk SPL

(sourcetype=cisco:ise OR sourcetype=ise-pic) (process="cmd.exe" OR process="powershell.exe" OR process="bash" OR process="sh") (commandline="-c" OR commandline="/c" OR commandline="-exec" OR commandline="-command") | table _time, host, process, commandline, parent_process

Sigma

title: Cisco ISE Improper Neutralization of Special Elements
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2026-20130 in Cisco ISE/ISE-PIC by monitoring for suspicious process execution indicative of injection attacks.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith:
      - '\java.exe'
      - '\tomcat.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash.exe'
      - '\sh.exe'
    CommandLine|contains:
      - '-c'
      - '/c'
      - '-exec'
      - '-command'
  condition: selection
fields:
  - Image
  - CommandLine
  - ParentImage
tags:
  - attack.execution
  - cve.2026.20130
  - cwe.74

Elastic ES|QL

from process where 
  (process.parent.executable.name : ("java.exe", "tomcat.exe") or process.parent.name : ("java", "tomcat")) and 
  (process.executable.name : ("cmd.exe", "powershell.exe", "bash", "sh")) and 
  (process.args : ("-c", "/c", "-exec", "-command"))
select @timestamp, host.name, process.executable.name, process.command_line, process.parent.executable.name, process.parent.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen