CVE-2026-20146
CVE-2026-20146: 2 tracked advisory records across Cisco. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Cisco
2 advisories- Advisory severityHigh
High [CVE-2026-20146 +6] Cisco Advance Notification for Publication of July 15, 2026, Security Advisories
cisco-sa-notice-ILh3ZrP5Source published Source updated
This bulletin covers 7 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
On July 15, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco RoomOS Security Hardening Release: July 2026 CVE-2026-20150 CVE-2026-20153 CVE-2026-20156 CVE-2026-20157 CVE-2026-20158 CVE-2026-20187 High 8.8 Cisco Identity Services Engine Path Traversal Vulnerability CVE-2026-20146 Medium 5.5 To fully remediate the vulnerabilities that were disclosed on July 15, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- On July 15, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) RoomOS To fully remediate vulnerabilities to be disclosed on July 15, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.
- Advisory severityMedium5.5
Medium [CVE-2026-20146] Cisco Identity Services Engine Path Traversal Vulnerability
cisco-sa-ise-traversal-xNt7wb2YSource published Source updated
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. The flaw is caused by improper validation of user-supplied input. Affected products named by the advisory: Identity Services Engine Software.
- Affected products in this advisory
- Identity Services Engine Software
- ISE Passive Identity Connector
- Source-reported affected versions
- Scope: At the time of publication, this vulnerability affected Cisco ISE and Cisco ISE-PIC, regardless of device configuration.
- Earlier than 3.3 — Migrate to a fixed release
- Release 3.3 (first fixed: 3.3 Patch 12 (Sep 2026))
- Release 3.4 (first fixed: 3.4 Patch 7 (Sep 2026) or hot patch)
1 more entries in the full advisory.
- Source-reported fixed versions
- 3.3 Patch 12 (Sep 2026)
- 3.4 Patch 7 (Sep 2026) or hot patch
- 3.5 Patch 4 (Sep 2026) or hot patch
- Mitigation guidance
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Earlier than 3.3: migrate to a fixed release.
- Release 3.3: upgrade to 3.3 Patch 12 (Sep 2026).
- Release 3.4: upgrade to 3.4 Patch 7 (Sep 2026) or hot patch.
1 more entries in the full advisory.
- Workarounds
- There are no workarounds that address this vulnerability.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.