Cisco has released a security update for its Identity Services Engine (ISE) to address a directory traversal vulnerability that could lead to sensitive information disclosure. The flaw, identified as CVE-2026-20148, carries a CVSS score of 4.9 and is tracked as ZDI-26-582 and ZDI-CAN-28708.
The vulnerability resides within the `PatchUpdateListener` method of the ISE software. It stems from insufficient validation of user-supplied paths before they are used in file operations. An authenticated remote attacker could exploit this weakness to access and disclose sensitive information.
Exploitation of this vulnerability requires a successful authentication to the affected ISE installation. Once authenticated, an attacker could leverage the flaw to disclose information within the context of the `iseadminportal` user. The CVSS vector string for this vulnerability is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network access, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
The vulnerability was initially reported to Cisco on December 18, 2025, by Jonathan Lein of Trend Research. Cisco subsequently developed a patch, and a coordinated public release of the security advisory occurred on August 13, 2026. The advisory, available on Cisco's security center, provides further details on the fix.
