Summary
CVE-2026-20190 is a high-severity information disclosure vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), carrying a CVSS v3.1 base score of 7.5 (High). The flaw stems from improper authorization checks on a remotely accessible resource, enabling an unauthenticated, remote attacker to retrieve sensitive information — specifically hashed credentials — from an affected device with no privileges and no user interaction required. Cisco published this advisory on June 17, 2026; no public proof-of-concept exploit or known malicious use has been reported at this time.
Technical details
- Root cause: Improper authorization (CWE-285) — a resource on the device can be accessed without the expected authorization controls being enforced.
- Trigger conditions: An attacker sends specially crafted network traffic to an affected Cisco ISE or ISE-PIC device; no authentication, credentials, or prior network access are required.
- Attack vector: Network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N).
- Impact: Successful exploitation allows the attacker to read hashed credentials stored on the device. According to Cisco, these hashed credentials "could be used in future attacks" — enabling offline password cracking, credential replay, and potential lateral movement across the enterprise network. Impact is limited to confidentiality (I:N, A:N); there is no reported integrity or availability impact.
Affected software
- Cisco Identity Services Engine (ISE):
- 3.4.0
- 3.4 Patch 1 through 3.4 Patch 5
- 3.5.0
- 3.5 Patch 1 through 3.5 Patch 2
- Cisco Identity Services Engine Passive Identity Connector (ISE-PIC):
- 3.4.0
Severity
CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate action: Apply the fixed software releases identified in the Cisco Security Advisory (cisco-sa-ise-multi-G5WP8vv). Refer to the advisory’s fixed-release table for the specific patch version required for your deployment.
- If patching is not immediately possible:
- Restrict external and untrusted network access to Cisco ISE and ISE-PIC management interfaces using firewall rules or access control lists.
- Ensure ISE administrative interfaces are not directly reachable from the internet or untrusted network segments.
- Monitor ISE access logs for anomalous or unexpected unauthenticated requests to internal resources.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.