Cisco ISE CVE-2026-20194

Requires an authenticated, high-privilege identity on Cisco ISE or ISE-PIC (PR:H) reachable over the network (AV:N); there is no user interaction and low attack complexity once that access is held. It applies to the ISE/ISE-PIC software versions addressed by hardening release cisco-sa-hardening-ise-XU5EwX5T (exact fixed versions not provided). The primary limiting factor is the high-privilege authentication prerequisite, which confines realistic exploitation to trusted insiders, compromised administrator credentials, or an attacker who has already gained an admin foothold; the grouped-advisory nature means the exact triggering feature or configuration is not publicly specified.

CVSS 3.1 base 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) rates this Critical, but the real-world priority is more nuanced than the headline number. The single most important limiter is PR:H: exploitation requires an already high-privilege authenticated identity on the ISE/ISE-PIC platform, so this is a privilege-abuse / lateral-movement flaw for a near-trusted insider or a compromised admin credential, not a pre-auth internet drive-by. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or automatable exploitation. The C:H/I:H/A:H plus S:C impacts and CWE-669 classification are vendor-asserted through an internal-review 'software hardening release' that groups MULTIPLE internally discovered vulnerabilities under one CVE, so the per-issue technical detail is deliberately vague and cannot be independently verified. Net: a genuine and worth-patching flaw on a sensitive identity platform, but the PR:H gate plus absence of KEV/POC/EPSS signals make it a scheduled-remediation item rather than an emergency, high-CVSS-driven fire drill - the score is elevated largely by the generous vendor-asserted impact and scope-change rather than by demonstrated ease of real-world exploitation.

An attacker who already holds high-privilege authenticated access to Cisco ISE or ISE-PIC (for example a compromised admin account or malicious operator) sends crafted requests that exploit improper transfer of a resource across a trust/privilege boundary (CWE-669), causing the platform to read, modify, or disrupt resources outside the attacker's intended sphere. Because CVSS marks scope changed (S:C) with C:H/I:H/A:H, the abuse can cascade beyond the vulnerable component to affect the broader identity/NAC control plane. No public proof-of-concept is available and no active exploitation is reported.