A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Identity Services Engine Software unknown
Version Status Constraints
3.1.0 affected —
3.1.0 p1 affected —
3.1.0 p3 affected —
3.1.0 p2 affected —
3.2.0 affected —
3.1.0 p4 affected —
3.1.0 p5 affected —
3.2.0 p1 affected —
3.1.0 p6 affected —
3.2.0 p2 affected —
3.1.0 p7 affected —
3.3.0 affected —
3.2.0 p3 affected —
3.2.0 p4 affected —
3.1.0 p8 affected —
3.2.0 p5 affected —
3.2.0 p6 affected —
3.1.0 p9 affected —
3.3 Patch 2 affected —
3.3 Patch 1 affected —
3.3 Patch 3 affected —
3.4.0 affected —
3.2.0 p7 affected —
3.3 Patch 4 affected —
3.4 Patch 1 affected —
3.1.0 p10 affected —
3.3 Patch 5 affected —
3.3 Patch 6 affected —
3.4 Patch 2 affected —
3.3 Patch 7 affected —
3.4 Patch 3 affected —
3.5.0 affected —
3.4 Patch 4 affected —
3.3 Patch 8 affected —
3.2 Patch 8 affected —
3.5 Patch 1 affected —
3.3 Patch 9 affected —
3.2 Patch 9 affected —
3.4 Patch 5 affected —
3.5 Patch 3 affected —
3.5 Patch 2 affected —
3.3 Patch 10 affected —
3.3 Patch 11 affected —
3.4 Patch 6 affected —
3.2 Patch 10 affected —
3.1.0 p72 affected —
3.1.0 p11 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-inf-disc-LFWvcCu cve-icon cve-icon
History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.
Title Cisco Identity Services Engine Information Disclosure Vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-09-16T20:19:02.744Z

Reserved: 2025-10-08T11:59:15.400Z

Link: CVE-2026-20235

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T21:17:08.060

Modified: 2026-09-16T21:17:08.060

Link: CVE-2026-20235

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses