Cisco Addresses Medium-Severity Vulnerability in Identity Services Engine

Cisco has issued updates to rectify a medium-severity security flaw identified in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). This vulnerability, tracked as CVE-2026-20029, has a CVSS score of 4.9 and is linked to improper parsing of XML processed by the web-based management interface. The flaw could allow an authenticated remote attacker with administrative privileges to access sensitive information by uploading a malicious file to the application.

Cisco Patches ISE Security Vulnerability After Public PoC Exploit ReleaseTechRadar

The vulnerability enables attackers to read arbitrary files from the underlying operating system, which should typically be restricted even for administrators. Cisco's advisory indicated that there are no workarounds available, emphasizing that patching is the only solution. The affected versions include:

TechRadar

• Cisco ISE or ISE-PIC Release earlier than 3.2

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

• Cisco ISE or ISE-PIC Release 3.2 - 3.2 Patch 8

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

• Cisco ISE or ISE-PIC Release 3.3 - 3.3 Patch 8

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

• Cisco ISE or ISE-PIC Release 3.4 - 3.4 Patch 4

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

• Cisco ISE or ISE-PIC Release 3.5 - Not vulnerable

Cisco Patches ISE Security Vulnerability After Public PoC Exploit ReleaseTechRadar

Cisco's Identity Services Engine is widely utilized in medium to large enterprise environments for centralized network access control, making it a prime target for cybercriminals. The presence of a proof-of-concept exploit raises concerns about potential exploitation, although Cisco reported no evidence of the vulnerability being actively exploited in the wild. The company has also addressed two additional medium-severity vulnerabilities related to the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests, which could lead to information leakage or denial of service.

TechRadar

Cisco stated, "An attacker could exploit this vulnerability by uploading a malicious file to the application," highlighting the critical nature of the flaw. The company urged users to update to the latest versions to ensure adequate protection against potential threats.

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

While Cisco has taken steps to address the vulnerability, some cybersecurity experts express concern over the frequency of vulnerabilities in its products. The availability of a proof-of-concept exploit suggests that organizations may soon face risks if they do not act promptly to patch their systems.

TechRadar

Organizations using affected versions of Cisco ISE and ISE-PIC are advised to implement the necessary patches immediately to mitigate risks associated with this vulnerability. Continuous monitoring for updates and potential threats remains essential as cybercriminals increasingly target enterprise network access controls.

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release