Incorrect Resource Transfer Between Spheres in Cisco Identity Services Engine (ISE) - CVE-2026-20194
Published: September 17, 2026
Vulnerability identifier: #VU150706
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20194
CWE-ID: CWE-669
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to incorrect resource transfer between spheres in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) when transferring resources between security spheres. A remote attacker can exploit the vulnerability to compromise confidentiality, integrity, and availability.
Affected software
Cisco Identity Services Engine (ISE)
How to mitigate CVE-2026-20194
Install security update from vendor's website.
Cisco Identity Services Engine (ISE) - addressed in versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4