Cisco Identity Services Engine Missing Authentication for Critical Function Information Disclosure Vulnerability

August 13th, 2026
ZDI-26-580 ZDI-CAN-29246

CVE ID

CVE-2026-20190

CVSS Score

7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors

Cisco

Affected Products

Identity Services Engine

Vulnerability Details

The vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of upgrade files. The issue results from the lack of authentication prior to allowing access to functionality. An attacker may be able to leverage this vulnerability to disclose stored credentials, leading to further compromise.

Additional Details

Cisco has issued an update to correct this vulnerability. More details can be found at:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv

Disclosure Timeline

  • 2026-02-12 - Vulnerability reported to vendor
  • 2026-08-13 - Coordinated public release of advisory
  • 2026-08-13 - Advisory Updated

Credit

Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative

Back to Advisories