EUVD-2026-44716
GHSA-37fr-rv4j-c6g2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
PR:H per mandatory admin credentials; C:H for arbitrary file read; I:H and A:L upgraded from vendor's I:L/A:N to reflect realistic impact of arbitrary OS file deletion.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files or delete arbitrary files on the affected system.
AnalysisAI
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Technical ContextAI
Cisco ISE is a network access control (NAC) and policy enforcement platform widely deployed in enterprise environments for AAA (Authentication, Authorization, Accounting) and endpoint posture assessment. ISE-PIC is the passive identity tracking connector variant. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly called path traversal. The affected software fails to adequately sanitize user-supplied input in HTTP requests, allowing directory traversal sequences (e.g., '../') to escape the intended file access boundary and reach arbitrary locations on the underlying OS filesystem. Both software components are identified via CPE strings cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:* and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector:*:*:*:*:*:*:*:*, with the wildcard version indicating a broad but unspecified version range per NVD data.
RemediationAI
Consult the Cisco Security Advisory cisco-sa-ise-traversal-xNt7wb2Y at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y for the specific fixed software release. Upgrade to the patched version identified there as the primary remediation. As a compensating control while patching is scheduled, strictly limit administrative access to ISE and ISE-PIC to a minimal set of trusted, audited accounts; enforce multi-factor authentication for all admin logins to reduce risk from compromised credentials. Enabling detailed HTTP request logging for the ISE admin portal can assist in detecting traversal attempt patterns (e.g., encoded '../' sequences in request paths). Note that restricting admin access reduces attack surface but does not eliminate the vulnerability in unpatched deployments - the underlying input validation flaw persists until the software is updated.
We need to produce a JSON with specific fields. The input: CVE-2026-20186, a Cisco ISE vulnerability. Description says:
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unaut
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to i
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authentica
We need to produce a JSON object with the specified fields. Let's begin by examining all provided data. CVE-2026-20132:
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADI
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today