Cisco Identity Services Engine Leaks Information Due to Missing Authentication

Cisco has addressed a critical information disclosure vulnerability in its Identity Services Engine (ISE) that could allow unauthenticated remote attackers to access sensitive data, including stored credentials. The flaw, identified as CVE-2026-20190, stems from a missing authentication check in the handling of upgrade files.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. It specifically affects Cisco ISE installations and does not require any prior authentication to exploit. Attackers could leverage this weakness to disclose information that could lead to further compromise of affected systems.

The issue was first reported to Cisco on February 12, 2026, by Bobby Gould of TrendAI Zero Day Initiative. Cisco subsequently developed and released an update to correct the vulnerability. The coordinated public release of the security advisory, ZDI-26-580 (ZDI-CAN-29246), occurred on August 13, 2026, the same day the advisory was updated.

Cisco's security advisory, cisco-sa-ise-multi-G5WP8vv, provides further details on the vulnerability and the necessary patches. Users of Cisco Identity Services Engine are urged to apply the available updates to mitigate the risk of exploitation.