← Back

CVE-2026-20234

nvd nist
Published: Sep 16, 2026Modified: Sep 28, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: psirt@cisco.com (Secondary)

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20234 are related to insufficiently protected credentials issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522.

Affected (42)

Cisco
2 products
Identity Services Engine
Identity Services Engine Passive Identity Connector
Configuration A
23 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Identity Services Engine
3.1.0 ≤ version < 3.3.0
Identity Services Engine
Version 3.3.0 patch10
Identity Services Engine
Version 3.3.0 patch11
Identity Services Engine
Version 3.3.0 patch1
Identity Services Engine
Version 3.3.0 patch2
Identity Services Engine
Version 3.3.0 patch3
Identity Services Engine
Version 3.3.0 patch4
Identity Services Engine
Version 3.3.0 patch5
Identity Services Engine
Version 3.3.0 patch6
Identity Services Engine
Version 3.3.0 patch7
Identity Services Engine
Version 3.3.0 patch8
Identity Services Engine
Version 3.3.0 patch9
Identity Services Engine
Version 3.4.0
Identity Services Engine
Version 3.4.0 patch1
Identity Services Engine
Version 3.4.0 patch2
Identity Services Engine
Version 3.4.0 patch3
Identity Services Engine
Version 3.4.0 patch4
Identity Services Engine
Version 3.4.0 patch5
Identity Services Engine
Version 3.4.0 patch6
Identity Services Engine
Version 3.5.0
Identity Services Engine
Version 3.5.0 patch1
Identity Services Engine
Version 3.5.0 patch2
Identity Services Engine
Version 3.5.0 patch3
Configuration B
19 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Identity Services Engine Passive Identity Connector
3.1.0 ≤ version < 3.3.0
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch10
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch11
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch1
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch2
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch3
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch4
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch5
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch6
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch7
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch8
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch9
Identity Services Engine Passive Identity Connector
Version 3.4.0
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch1
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch2
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch3
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch4
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch5
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch6

Related CWEs

CWE-522
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (1)

Source: psirt@cisco.com
Vendor Advisory

Timeline

No history available yet.