What is the CVSS score of CVE-2026-20190?

CVE-2026-20190 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Cisco ISE are affected by CVE-2026-20190?

Cisco Identity Services Engine (ISE) and Passive Identity Connector expose employee credentials to external attackers without requiring authentication, creating an open pathway for credential theft…

How to fix or mitigate CVE-2026-20190?

Within 24 hours: Inventory all Cisco ISE and ISE-PIC instances in production; immediately restrict network access to ISE systems to authorized administrative networks only using firewall rules; enable enhanced logging of all ISE resource access. Within 7 days: Implement a reverse proxy or WAF in front of ISE systems requiring additional authentication; conduct mandatory password resets for all user accounts managed through affected ISE instances; implement continuous monitoring and alerting for unauthorized ISE access attempts. Within 30 days: Monitor Cisco security advisories daily for patch release information; establish vendor communication channel for vulnerability updates; develop and test patch deployment plan in lab environment matching production configuration; prepare production rollout strategy.

Cisco ISE CVE-2026-20190

HIGH

Improper Authorization (CWE-285)

2026-06-17 cisco

Authentication Bypass Cisco Cisco Identity Services Engine Software Cisco Ise Passive Identity Connector

7.5

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Description states unauthenticated remote attacker sending crafted traffic obtains sensitive data including hashed credentials - pure confidentiality impact, no integrity or availability effect, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 16:54 vuln.today

CVE Published

Jun 17, 2026 - 16:17 cve.org

HIGH 7.5

DescriptionCVE.org

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device.

This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

AnalysisAI

Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Cisco ISE is Cisco's network access control (NAC) and policy enforcement platform used for 802.1X, TACACS+, and RADIUS-based authentication of users and endpoints across enterprise networks; ISE-PIC is the lighter Passive Identity Connector variant that consumes identity information from sources such as Active Directory. The CPEs cpe:2.3:a:cisco:cisco_identity_services_engine_software and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector confirm both products are in scope. The flaw is classified as CWE-285 (Improper Authorization): a resource handler accepts requests without verifying that the caller is entitled to read the underlying data, so privileged information - including credential hashes used for downstream authentication - is returned to anonymous callers. Because ISE stores identity material for the entire enterprise authentication fabric, leaked hashes are high-value for offline cracking and pass-the-hash/relay style follow-on attacks.

RemediationAI

Patch available per vendor advisory: upgrade Cisco ISE and ISE-PIC to the fixed release identified in cisco-sa-ise-multi-G5WP8vv (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv); the exact fixed version was not included in the input data and must be read from that advisory. Until the upgrade is applied, restrict network reachability to the ISE administrative and node-communication interfaces using infrastructure ACLs or management-network segmentation so that only trusted administrative hosts and required peer ISE nodes can send traffic to the vulnerable endpoint - the trade-off is that overly tight ACLs can break pxGrid consumers, profiling feeds, or distributed-deployment node sync, so validate against your topology. Rotate any credentials whose hashes may have transited the ISE identity store (local admin accounts, sponsor accounts, and any service accounts integrated with ISE) once patched, since prior unauthenticated reads cannot be retroactively detected. Increase logging on ISE admin/API interfaces and monitor for anomalous unauthenticated requests against the affected resource path while the patch window is open.