Cisco ISE CVE-2026-20192

Exploitation requires only network access to a Cisco ISE or ISE-PIC deployment's reachable interface - the CVSS vector is AV:N/AC:L/PR:N/UI:N, i.e. no authentication, no user interaction, and low attack complexity against affected releases. The primary limiting factor is that ISE management/admin planes are typically deployed on segmented or restricted networks, so real-world reachability depends on whether the vulnerable interface is exposed to the attacker's position; there is no described feature-flag or non-default-configuration prerequisite, but because this is a grouped hardening advisory the specific triggering component is not disclosed. Defenders should treat any ISE/ISE-PIC instance running a pre-hardening release as exploitable if network-reachable.

This is the single most severe member of the Cisco ISE 'cisco-sa-hardening-ise-XU5EwX5T' advisory family and warrants top-priority patching. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change and full confidentiality/integrity/availability impact - the maximum possible score. Critically, PR:N here distinguishes it from its authenticated siblings CVE-2026-20194 and CVE-2026-20237 (both PR:H, 9.1) that share the exact same advisory; on an identity/NAC platform an unauthenticated access-control failure is a genuine crown-jewel exposure. That said, the severity is tempered by advisory vagueness: this is a grouped hardening release covering 'multiple internally discovered vulnerabilities' under Pillar CWE-284, so the 10.0 impact metrics are vendor-asserted with no per-vulnerability technical detail, no exploit primitive described, and no affected-version list in the provided data. No EPSS score, no CISA KEV listing, and no public POC are present, and there is no SSVC decision data - so despite the perfect CVSS, there is currently no evidence of active or imminent exploitation. Net read: prioritize as critical on CVSS + unauth + ubiquitous identity-plane exposure, but recognize the real-world signal is 'vendor-scored maximum, not yet demonstrated exploitable.'

A remote, unauthenticated attacker with only network reachability to the ISE/ISE-PIC management or service interface sends crafted requests that abuse a missing or broken access-control check, gaining unauthorized access to functions or data across a trust boundary (S:C). Because ISE governs network admission and identity, this could cascade into manipulation of authentication/authorization policy for downstream network devices. No public exploit code is identified at time of analysis, and the grouped advisory provides no reproduction detail.