CVE-2026-20190: Cisco ISE Information Disclosure Flaw

CVE-2026-20190 Overview

CVE-2026-20190 is an authorization flaw in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerability allows an unauthenticated, remote attacker to retrieve sensitive information from an affected device by sending crafted traffic over the network. Improper authorization checks on a protected resource enable unauthorized access without credentials or user interaction. According to the Cisco advisory, exposed data can include hashed credentials usable in follow-on attacks against authentication services and downstream identity infrastructure.

Critical Impact
An unauthenticated remote attacker can retrieve hashed credentials and other sensitive data from Cisco ISE and ISE-PIC, enabling credential cracking and lateral movement.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco ISE Passive Identity Connector (ISE-PIC)
Refer to the Cisco Security Advisory for specific affected versions

Discovery Timeline

2026-06-17 - CVE-2026-20190 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-20190

Vulnerability Analysis

The flaw is classified under [CWE-285] Improper Authorization. Cisco ISE and ISE-PIC fail to enforce sufficient authorization checks when a specific resource is accessed over the network. As a result, requests that should require authenticated and privileged context are processed without verification of the requester's identity or permissions.

A successful exploit returns sensitive information, including hashed credentials. An attacker can take these hashes offline for brute-force or dictionary attacks. Recovered credentials may then be reused against Active Directory, RADIUS clients, administrative consoles, or other systems federated with the ISE deployment.

The vulnerability impacts confidentiality only. Integrity and availability of the device are not directly affected. However, the disclosed material substantially increases the blast radius of any subsequent intrusion because ISE sits at the center of network access control decisions.

Root Cause

The root cause is missing or incomplete authorization logic on a resource endpoint. The application validates that a request is well-formed but does not verify that the caller is permitted to read the targeted data. This is a classic broken access control pattern where authentication state and authorization policy are decoupled.

Attack Vector

Exploitation requires network reachability to the affected ISE or ISE-PIC interface. The attacker sends crafted HTTP traffic to the vulnerable resource and parses the response for sensitive content. No credentials, prior foothold, or user interaction is required, making the vulnerability suitable for opportunistic scanning of internet-exposed or insufficiently segmented management interfaces.

No verified public proof-of-concept code is available at the time of publication. See the Cisco Security Advisory for technical specifics.

Detection Methods for CVE-2026-20190

Indicators of Compromise

Unauthenticated HTTP/HTTPS requests to ISE administrative or API endpoints originating from unexpected source addresses
Anomalous response sizes from ISE web services consistent with bulk data retrieval
Outbound connections from ISE to unfamiliar destinations following inbound probing

Detection Strategies

Inspect ISE web server access logs for repeated requests to the resource paths identified in the Cisco advisory
Correlate failed authentication spikes across downstream systems with prior anomalous access to ISE
Deploy network IDS signatures that match the crafted request patterns once published by Cisco or community sources

Monitoring Recommendations

Forward ISE syslog, application, and access logs to a centralized analytics platform for retention and correlation
Alert on any unauthenticated access to administrative URIs on TCP 443 of ISE nodes
Baseline normal API consumers and flag deviations in user-agent, source IP, or request volume

How to Mitigate CVE-2026-20190

Immediate Actions Required

Identify all Cisco ISE and ISE-PIC nodes in the environment and confirm version against the Cisco advisory
Restrict access to ISE management and API interfaces to trusted administrative subnets only
Rotate any credentials that may have been exposed if compromise is suspected, prioritizing administrator and service accounts

Patch Information

Cisco has published fixed software releases. Review the Cisco Security Advisory cisco-sa-ise-multi-G5WP8vv for the specific fixed versions and upgrade guidance applicable to your deployment. Apply the patches through standard Cisco ISE upgrade procedures.

Workarounds

Cisco has not documented a workaround for this issue; upgrading to a fixed release is required
As a compensating control, place ISE behind firewall ACLs that permit access only from authorized management hosts
Disable or remove any unused administrative interfaces and external integrations until patching is complete

bash

# Example: restrict ISE admin interface access at the network edge
access-list ISE_ADMIN permit tcp host 10.10.10.5 host 192.0.2.10 eq 443
access-list ISE_ADMIN deny   tcp any host 192.0.2.10 eq 443
access-list ISE_ADMIN permit ip any any
interface GigabitEthernet0/1
 ip access-group ISE_ADMIN in