Cisco ISE CVE-2026-20195

No authentication required - the affected API endpoint responds to unauthenticated requests. The endpoint must be network-accessible (not blocked by firewall or access control lists). Exploitation requires the attacker to craft requests and analyze response differentiation; no special ISE configuration or non-default settings are mentioned as prerequisites, suggesting the vulnerability affects standard ISE deployments. The attack succeeds only if the endpoint returns detectable differences in error messages or HTTP status codes based on username validity - this is the core condition that enables enumeration.

CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L indicates network-accessible, unauthenticated exploitation with no user interaction required - a favorable attack posture for reconnaissance. However, the impact is limited to confidentiality (partial disclosure of usernames only); there is no integrity or availability impact. This is a classic information disclosure vulnerability with low real-world severity despite moderate CVSS score. The enumerated usernames alone do not enable direct compromise but serve as intelligence for follow-on attacks (credential stuffing, targeted phishing, or targeting specific administrators). Exploitation requires multiple requests and response analysis, which may be detectable by WAF or API rate limiting controls. EPSS data not provided in input. KEV status not provided - if not listed by CISA, this indicates lower real-world exploitation pressure despite being network-accessible. The vulnerability is most dangerous in environments where usernames are not already public knowledge and where the ISE instance is internet-facing without access controls.

An attacker without credentials performs network reconnaissance of a Cisco ISE instance and identifies the identity management API endpoint. The attacker sends a series of HTTP requests to the endpoint with common or extracted usernames, comparing response codes and error messages. Valid usernames receive one response pattern (e.g., 'User not found' with HTTP 404), while invalid usernames receive another (e.g., 'Authentication failed' with HTTP 401). By analyzing dozens or hundreds of requests, the attacker compiles a list of valid ISE administrators and directory users, which are then used for credential stuffing or targeted phishing campaigns against identified accounts.