SB20260917238 - Multiple vulnerabilities in Cisco Identity Services Engine (ISE)
Published: September 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when processing output for downstream components. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
2) Improper access control (CVE-ID: CVE-2026-20192)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper access control in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when enforcing access controls. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
3) Incorrect Resource Transfer Between Spheres (CVE-ID: CVE-2026-20194)
CWE-ID: CWE-669 - Incorrect Resource Transfer Between Spheres
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to incorrect resource transfer between spheres in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when transferring resources between security spheres. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
4) Insufficiently protected credentials (CVE-ID: CVE-2026-20234)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to insufficiently protected credentials in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when handling credentials. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
5) Input validation error (CVE-ID: CVE-2026-20237)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when processing input. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
6) Improper privilege management (CVE-ID: CVE-2026-20287)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when managing privileges. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
Remediation
Install update from vendor's website.