CVE-2026-20190: Cisco Identity Services Engine Information Disclosure Vulnerability

Synopsis

An improper authorization check in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated remote attacker to access protected resources without credentials. The vulnerability is reachable over the network with no authentication required and no user interaction needed, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation exposes sensitive information including hashed credentials that an attacker can use in follow-on attacks such as offline password cracking or credential stuffing. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Cisco ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ISE or ISE-PIC service over the network; the attack vector is Network (AV:N), meaning no local or physical access is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a fully unauthenticated remote attacker (PR:N).

• Victim interactionNot required

  The attacker sends crafted traffic directly to the device and does not need any action from a user or administrator (UI:N).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker reads sensitive data stored on the ISE device, including hashed user credentials that can be taken offline for cracking or reused in credential-stuffing campaigns.
• Because ISE is a network access control platform, exposed credential hashes may correspond to network device accounts, VPN users, or administrator identities, broadening the downstream attack surface.
• Confidentiality impact is rated High (C:H); integrity and availability are unaffected, so the immediate harm is data disclosure rather than service disruption or data modification.