CVE-2026-20190

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
Cisco	Cisco Identity Services Engine Software	3.4.0; 3.4 Patch 1; 3.4 Patch 2; 3.4 Patch 3; 3.5.0; 3.4 Patch 4; 3.5 Patch 1; 3.4 Patch 5; 3.5 Patch 2
Cisco	Cisco ISE Passive Identity Connector	3.4.0

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vvVendor Advisory

Timeline

Published: Jun 17, 2026
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-201917.5A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container CVE-2026-2019210.0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass CVE-2026-201934.3A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administra CVE-2026-201949.1As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass CVE-2026-201955.3A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user CVE-2026-201975.8Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote a CVE-2026-201984.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote a CVE-2026-201997.2A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to exe CVE-2026-20207.5The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included CVE-2026-202008.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to exec CVE-2026-202026.6In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 1 CVE-2026-202034.3In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 1