Cisco ISE CVE-2026-20190

No special conditions - remote unauthenticated exploitation against default configurations of Cisco ISE and ISE-PIC, requiring only network reachability to the affected resource (CVSS AV:N/AC:L/PR:N/UI:N). The practical limiter is network exposure: ISE administrative and node-communication interfaces are normally bound to a dedicated management segment, so an attacker must either sit on that segment, traverse it via an upstream compromise, or reach an instance whose management interface has been inadvertently exposed to a less trusted network. No user interaction, specific feature toggle, or non-default option is called out in the description as a precondition.

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector (7.5 High) is internally consistent with the description: network-reachable, no authentication, no user interaction, and pure confidentiality impact with no integrity or availability effect. SSVC-style decomposition: exploitation status is 'none' (no KEV, no public POC referenced), automatable is plausibly 'yes' given an unauthenticated HTTP-style request can likely be scripted, and technical impact is 'partial' (read-only disclosure rather than full system compromise). EPSS data was not supplied, so probability of near-term mass exploitation cannot be quantified. Net real-world risk is meaningful - ISE is typically reachable from management segments and sometimes more broadly, and the leaked hashed credentials extend the blast radius into Active Directory and network-device administration - but priority should be calibrated against exposure: internet-exposed or large flat-management-network ISE deployments warrant urgent patching, while strictly segmented deployments can follow normal change windows.

An attacker with network reachability to an ISE or ISE-PIC node sends a crafted HTTP(S) request to the vulnerable resource that omits or bypasses authorization, and the server returns sensitive data including hashed user credentials. The attacker then performs offline cracking or pass-the-hash/relay attacks against the recovered material to authenticate into AD-integrated systems, network devices managed via TACACS+, or the ISE admin plane itself. No public exploit identified at time of analysis, but the CVSS AC:L/PR:N profile means weaponization once details are public would be straightforward.