Cisco ISE CVE-2026-20072

Exploitation requires an authenticated Cisco ISE administrator account that has been granted management rights over network users; the attacker then uses the user-export feature, whose underlying files lack proper authorization enforcement, to read data for users outside their assigned security group. The key limiting factors are: valid administrative credentials (PR:H), possession of user-management delegation, and access to the web-based management interface - this is not exploitable by unauthenticated or read-only/unprivileged users. The impact is confined to disclosure of user data (including normally-hidden passwords); there is no integrity or availability effect. Affects ISE 3.1 through 3.5 (and ISE-PIC equivalents) prior to fixed patch levels.

This is a genuine but tightly-gated confidentiality issue, not a broad emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 Medium) tells the real story: while network-reachable and low-complexity, exploitation requires PR:H - specifically an authenticated administrator who already holds management rights over network users. The C:H rating reflects that the leaked data includes user passwords normally hidden from administrators, but I:N/A:N confirm there is no integrity or availability impact; this is a pure information-disclosure/authorization flaw (CWE-863). No EPSS score, no CISA KEV listing, and no public POC were provided, so the current status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS combined with the high privilege requirement means this is a lower-priority patch item than the unauthenticated ISE flaws in the same product family (e.g. the unauthenticated SQLi CVE-2026-20247). One data-quality caveat: the 'Authentication Bypass' tag conflicts with the actual mechanism - this is an authorization (CWE-863) failure exploited BY an authenticated admin, not an authentication bypass. Overall: a real but narrow insider/privilege-boundary risk, appropriately scored Medium.

A lower-tier Cisco ISE administrator who has been delegated management rights over one set of network users abuses a user-export function whose backing files lack proper authorization checks. By exporting users, the attacker retrieves sensitive data - including user passwords - for accounts outside their assigned security group, data that should be invisible to them. No public exploit code is currently identified; exploitation requires existing administrative access to the ISE web UI.