CVE-2026-20190

Cisco Identity Services Engine Information Disclosure Vulnerability

State: Published
Severity: 7.5 High
Published: Jun 17, 2026
Updated: Jun 17, 2026
Reserved: Oct 8, 2025

Description

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device.

This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	cisco

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Cisco Identity Services Engine SoftwareCisco	3.4.0Affected 3.4 Patch 1Affected 3.4 Patch 2Affected 3.4 Patch 3Affected 3.5.0Affected 3.4 Patch 4Affected 3.5 Patch 1Affected 3.4 Patch 5Affected 3.5 Patch 2Affected
Cisco ISE Passive Identity ConnectorCisco	3.4.0Affected

References

cisco-sa-ise-multi-G5WP8vv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.