Executive Summary

A deserialization flaw in Cisco Identity Services Engine’s AlarmMessageDiskQueue component allows authenticated remote attackers to execute arbitrary code. The vulnerability, rated CVSS 7.2, is identified as CVE-2026-20211 and was disclosed by the Zero Day Initiative.

---

Intelligence Metadata - Source Publisher: Zero Day Initiative - Published Date: 2026-09-18T05:00:00+00:00 - Category: cves

Original Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20211.

"Great indeed is the sublimity of the Creative, to which all beings owe their beginning and which permeates all heaven."

— Lao Tzu