Medium [CVE-2026-20146] Cisco Identity Services Engine Path Traversal Vulnerability
This medium-severity Cisco advisory covers CVE-2026-20146 affecting Identity Services Engine Software, ISE Passive Identity Connector.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system.
A successful exploit could allow the attacker to access sensitive files or delete arbitrary files on the affected system.
Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Affected products named by the advisory: Identity Services Engine Software.
- Scope: At the time of publication, this vulnerability affected Cisco ISE and Cisco ISE-PIC, regardless of device configuration.
- Earlier than 3.3 — Migrate to a fixed release
- Release 3.3 (first fixed: 3.3 Patch 12 (Sep 2026))
- Release 3.4 (first fixed: 3.4 Patch 7 (Sep 2026) or hot patch)
- Release 3.51 (first fixed: 3.5 Patch 4 (Sep 2026) or hot patch)
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 3.3 Patch 12 (Sep 2026)
- 3.4 Patch 7 (Sep 2026) or hot patch
- 3.5 Patch 4 (Sep 2026) or hot patch
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Earlier than 3.3: migrate to a fixed release.
- Release 3.3: upgrade to 3.3 Patch 12 (Sep 2026).
- Release 3.4: upgrade to 3.4 Patch 7 (Sep 2026) or hot patch.
- Release 3.51: upgrade to 3.5 Patch 4 (Sep 2026) or hot patch.
- There are no workarounds that address this vulnerability.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.