CVE-2026-20190

Published: Jun 17, 2026Modified: Jun 22, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: psirt@cisco.com (Secondary)

Description

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

Affected (18)

Products: Cisco: Identity Services Engine, Identity Services Engine Passive Identity Connector

Cisco

2 products

Identity Services Engine

Identity Services Engine Passive Identity Connector

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Cisco Identity Services Engine	Version 3.4.0
Cisco Identity Services Engine	Version 3.4.0 patch1
Cisco Identity Services Engine	Version 3.4.0 patch2
Cisco Identity Services Engine	Version 3.4.0 patch3
Cisco Identity Services Engine	Version 3.4.0 patch4
Cisco Identity Services Engine	Version 3.4.0 patch5
Cisco Identity Services Engine	Version 3.5.0
Cisco Identity Services Engine	Version 3.5.0 patch1
Cisco Identity Services Engine	Version 3.5.0 patch2

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch2
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch3
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch4
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch5
Cisco Identity Services Engine Passive Identity Connector	Version 3.5.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.5.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.5.0 patch2

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.