CVE-2026-20235: Cisco ISE API Information Disclosure Flaw

CVE-2026-20235 Overview

CVE-2026-20235 is an information disclosure vulnerability in the API of Cisco Identity Services Engine (ISE). An authenticated, remote attacker with valid administrative credentials can view sensitive information on an affected device by sending a crafted API request. The flaw stems from insufficient validation of user-supplied parameters, categorized under [CWE-89] (SQL Injection). Successful exploitation exposes sensitive data, including hashed credentials that attackers can leverage in follow-on attacks against the identity infrastructure.

Critical Impact
Exposure of hashed administrative credentials from a Cisco ISE deployment can enable offline password cracking and lateral movement across identity, network access control, and downstream systems that trust ISE for authentication.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco ISE API interface exposed to administrative users
Refer to the Cisco Security Advisory for the authoritative list of fixed releases

Discovery Timeline

2026-09-16 - CVE-2026-20235 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-20235

Vulnerability Analysis

Cisco ISE is a policy management and network access control platform that authenticates users and devices across enterprise networks. The vulnerability resides in the platform's administrative API layer. An attacker holding valid administrative credentials can submit crafted API parameters that the backend fails to validate before incorporating them into a database query.

The CWE-89 classification indicates the underlying issue is SQL injection reachable through parameter handling in an API endpoint. Because ISE stores authentication material, credential hashes, and configuration data, a successful query manipulation returns records beyond the caller's intended scope. The disclosed hashes can then be attacked offline with GPU-accelerated cracking tools.

The vulnerability affects confidentiality only. Integrity and availability of the ISE node are not directly impacted by exploitation.

Root Cause

The root cause is insufficient input validation on user-supplied parameters within API request handlers. Untrusted input is passed into a data access path without adequate sanitization or parameterized query enforcement. This permits an authenticated attacker to alter query semantics and extract records the API was not designed to return.

Attack Vector

Exploitation requires network access to the ISE administrative API and valid administrative credentials. The attacker crafts an API request that embeds malicious parameter values. The affected endpoint processes the request, executes the manipulated query, and returns sensitive data including hashed credentials in the response.

Because administrative credentials are required, the practical risk scenario involves credential theft, insider misuse, or a compromised administrator workstation used as a pivot into the ISE API.

No public proof-of-concept exploit is currently available. Technical details are documented in the Cisco Security Advisory.

Detection Methods for CVE-2026-20235

Indicators of Compromise

API requests to Cisco ISE administrative endpoints containing SQL metacharacters, UNION statements, or encoded query fragments in parameter values
Unusually large or repeated API responses returned to a single administrative session, consistent with bulk data extraction
Administrative API access from source IP addresses, geolocations, or times of day that deviate from established administrator baselines

Detection Strategies

Enable and centralize Cisco ISE administrative audit logs and API access logs in a SIEM for correlation and long-term retention
Alert on API parameters containing SQL syntax patterns such as ' OR , UNION SELECT, --, or hex-encoded payloads
Correlate administrator authentication events with subsequent API activity to identify session anomalies or credential misuse

Monitoring Recommendations

Monitor for outbound data volume spikes from ISE administrative sessions that could indicate bulk credential extraction
Track failed input validation errors surfaced in ISE application logs, which may indicate reconnaissance against the vulnerable endpoint
Review privileged administrator account usage weekly and rotate credentials suspected of exposure

How to Mitigate CVE-2026-20235

Immediate Actions Required

Apply the fixed Cisco ISE software release listed in the Cisco Security Advisory as soon as a maintenance window permits
Rotate all Cisco ISE administrative account credentials and any service account passwords whose hashes may have been retrievable through the API
Restrict administrative API access to a dedicated management network segment and known jump hosts

Patch Information

Cisco has published a security advisory tracking this issue under the identifier cisco-sa-ise-inf-disc-LFWvcCu. Refer to the Cisco Security Advisory for fixed software versions, upgrade paths, and any interim guidance from the vendor. Cisco ISE upgrades typically follow the standard patch cycle for the Admin, Policy Service, and Monitoring node personas.

Workarounds

Enforce strong, unique passwords and multi-factor authentication for all Cisco ISE administrative accounts to raise the bar for the required prerequisite
Apply role-based access control so administrators receive only the minimum privileges required, reducing the population of accounts that can reach the vulnerable endpoint
Place the ISE administrative interface behind network access control lists that restrict connections to trusted management workstations
Review and reduce the number of accounts with full administrative privileges on ISE

bash

# Example: restrict Cisco ISE admin interface access with an upstream ACL
# Replace with your management subnet and ISE admin node address
permit tcp 10.10.20.0 0.0.0.255 host 10.50.1.10 eq 443
deny   tcp any host 10.50.1.10 eq 443 log