Cisco ISE 3.4 Patch 6

[millsbenjamin66]

Trying to upgrade to ISE to patch the newly published CVEs. Apparently the recommended approach from Cisco is to patch immediately. How am I supposed to do this if the patch isn’t available to download?

• CVE-2026-20147 - 'Improper Neutralization of Special Elements used in a Command' vulnerability - CVSS v3.1 Base Score: 9.9

• CVE-2026-20148 - 'Improper Limitation of a Pathname to a Restricted Directory' vulnerability - CVSS v3.1 Base Score: 4.9

• CVE-2026-20186 - 'Improper Neutralization of Special Elements used in a Command' vulnerability - CVSS v3.1 Base Score: 9.9

• CVE-2026-20180 - 'Improper Limitation of a Pathname to a Restricted Directory' vulnerability - CVSS v3.1 Base Score: 9.9

[aleabrahao]

Cisco says it will be available sometime in April, we need to wait.

[millsbenjamin66]

They really need to make that much more clearer. I couldn’t even get that answer from TAC

[aleabrahao]

[millsbenjamin66]

I’m sorry but in no way is that clear. We are in April 2026 and 3.3 Patch 11 is available to there is huge inconsistency.

[aleabrahao]

April isn't over yet, as far as I remember, so we have to wait.

[beepmeep]

We, as a Cisco partner was briefed about this... Don't you use a Cisco partner you could ask? Anyway, in the field notice about public TLS certs, there is the following paragraph, so they should arrive soon:

Upgrade Cisco ISE system software to a patch release that introduces updated certificate handling for certificates issued under the new CA policies. The following patches will be released starting mid-April 2026: 

Cisco ISE Release Patch

3.1	Patch 11
3.2	Patch 10
3.3	Patch 11
3.4	Patch 6
3.5	Patch 3

[Marcelo Morais]

Hi @millsbenjamin66 ,

 please take a look at ISE - CVE: release 3.x.

Hope this helps !