What’s Vulnerable › Vulnerabilities

CVE-2026-20190: Cisco Identity Services Engine Information Disclosure Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-09-25
• Weakness: CWE-285

Description

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

Affected products

• Cisco Identity Services Engine: 3.4.0, 3.4.0-patch1, 3.4.0-patch2, 3.4.0-patch3, 3.4.0-patch4, 3.4.0-patch5 (+3)
• Cisco Identity Services Engine Passive Identity Connector: 3.4.0, 3.4.0-patch1, 3.4.0-patch2, 3.4.0-patch3, 3.4.0-patch4, 3.4.0-patch5

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv

Get alerted when CVE-2026-20190 or the next vulnerability affects your stack