ZDI-26-581: Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability

Timeline

Detection, updates, and resolution for this record.

1. Aug 13, 2026 · Catalog

   Detected

   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20147.

Sources

• CVE.orgVulnerability recordCVE-2026-20147

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-20147

  30-day exploitation probability 10.4%

  first.org
• Zero Day InitiativeCoordinated disclosureZDI-26-581

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20147.

  zerodayinitiative.com