CVE-2026-20195: Cisco ISE Information Disclosure Flaw

CVE-2026-20195 Overview

CVE-2026-20195 is a user enumeration vulnerability in an identity management API endpoint of Cisco Identity Services Engine (ISE). The flaw allows an unauthenticated, remote attacker to identify valid user accounts on an affected device by analyzing differentiated error responses. The weakness is classified under CWE-204: Observable Response Discrepancy. While the vulnerability does not grant code execution or direct access, it provides reconnaissance value that supports follow-on credential attacks. Cisco published a security advisory addressing the issue.

Critical Impact

An unauthenticated remote attacker can compile a list of valid usernames on Cisco ISE, enabling targeted password spraying, credential stuffing, and phishing campaigns against confirmed accounts.

Affected Products

• Cisco Identity Services Engine (ISE)
• Cisco ISE identity management API endpoint
• Refer to the Cisco Security Advisory for affected version details

Discovery Timeline

• 2026-05-06 - CVE-2026-20195 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-20195

Vulnerability Analysis

The vulnerability resides in an identity management API endpoint exposed by Cisco ISE. When the endpoint receives requests referencing user accounts, it returns observably different responses depending on whether the supplied identifier corresponds to an existing account. An attacker iterates through candidate usernames and classifies each response to confirm valid accounts.

The attack does not require authentication, valid credentials, or user interaction. The attacker only needs network reachability to the ISE management API. Successful enumeration produces a curated list of legitimate usernames that adversaries use as input for password spraying, brute-force attacks, and targeted phishing.

Cisco ISE is widely deployed for network access control, posture assessment, and policy enforcement. Account names harvested from ISE typically map to corporate identities used across Active Directory, VPN, and privileged systems, which amplifies the downstream risk of this information disclosure.

Root Cause

The root cause is improper handling of error conditions in the affected API endpoint. The endpoint emits distinguishable error messages for valid versus invalid usernames, violating the principle that authentication and lookup endpoints must return uniform responses regardless of account existence. This is a textbook [CWE-204] observable response discrepancy.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a series of crafted HTTP requests to the vulnerable identity management API endpoint, varying the username parameter on each request. The attacker then compares response bodies, status codes, or timing characteristics to determine which usernames exist. No exploit code is required beyond a scripted request loop. Refer to the Cisco Security Advisory for technical details about the affected endpoint.

Detection Methods for CVE-2026-20195

Indicators of Compromise

• High volumes of requests to the Cisco ISE identity management API endpoint originating from a single source or small set of sources
• Sequential or dictionary-pattern usernames in API request parameters
• Repeated 4xx error responses from the ISE API followed by a smaller set of differentiated responses indicating valid accounts
• Subsequent authentication attempts against VPN, AD, or ISE itself using usernames previously queried via the API

Detection Strategies

• Enable verbose API access logging on Cisco ISE and forward logs to a centralized SIEM for correlation
• Build detections that identify rapid iteration over distinct usernames against the same API endpoint within short time windows
• Correlate ISE API enumeration patterns with downstream authentication failures across identity providers to surface multi-stage attacks
• Apply rate-based analytics to flag any client exceeding a baseline threshold of identity API requests

Monitoring Recommendations

• Monitor network flows to the ISE management interface and restrict access to administrative subnets only
• Track unique username cardinality per source IP per hour against ISE API endpoints
• Alert on anomalous user-agent strings or scripted clients querying the identity management API
• Review ISE administrative and API audit trails on a recurring schedule for enumeration patterns

How to Mitigate CVE-2026-20195

Immediate Actions Required

• Apply the fixed Cisco ISE software release as documented in the Cisco Security Advisory
• Restrict network access to the ISE management and API interfaces using ACLs and firewalls so that only authorized administrative hosts can reach them
• Review recent API access logs for evidence of enumeration activity and triage any suspicious source addresses
• Reset or closely monitor accounts that may have been confirmed via enumeration if exposure is suspected

Patch Information

Cisco has published guidance and fixed software for this vulnerability. Consult the Cisco Security Advisory cisco-sa-ise-unauth-bypass-uxjRXGpb for the list of affected releases, fixed versions, and upgrade procedures. Apply the patched release through standard Cisco ISE upgrade workflows and validate functionality in a staging environment before production rollout.

Workarounds

• Place the ISE API behind a reverse proxy or web application firewall that enforces rate limiting and blocks rapid sequential username queries
• Limit exposure of the ISE management plane to dedicated jump hosts and management VLANs only, removing any public reachability
• Enforce strong, unique passwords and multi-factor authentication on all accounts so that enumeration alone provides limited follow-on value
• Monitor and alert on enumeration signatures while patching is scheduled, treating any detection as a precursor to credential attacks

# Example ACL concept to restrict ISE API access to a management subnet
# Replace interface and subnet values to match your environment
ip access-list extended ISE-MGMT-ACL
 permit tcp 10.10.50.0 0.0.0.255 host <ISE_IP> eq 443
 deny   tcp any host <ISE_IP> eq 443 log
 permit ip any any
!
interface GigabitEthernet0/1
 ip access-group ISE-MGMT-ACL in