Cisco ISE CVE-2026-20234

Exploitation requires network reachability to a Cisco ISE or ISE Passive Identity Connector (ISE-PIC) deployment and a valid low-privilege authenticated session (CVSS PR:L) - it is not anonymous/unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are the requirement for prior authenticated access to ISE and the specific (unspecified) credential-handling code paths introduced/fixed in the affected releases; the scope change (S:C) means recovered credentials extend impact to systems beyond ISE. Applies to affected ISE/ISE-PIC versions covered by the hardening release; consult advisory cisco-sa-hardening-ise-XU5EwX5T for exact fixed versions.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw needing only low-privilege authentication (PR:L), with a scope change (S:C) and total confidentiality/integrity/availability impact - a critical rating for Cisco ISE, a widely deployed enterprise Network Access Control platform. However, the description is notably thin: it is a bundled 'software hardening release' covering 'multiple internally discovered vulnerabilities' grouped under the CWE-522 pillar (insufficiently protected credentials), reported by Cisco's own PSIRT with no per-vuln technical detail. No EPSS score, no CISA KEV listing, and no public POC were provided, and the flaws were found via internal review rather than in-the-wild activity - so this is a proactively-patched, vendor-discovered issue rather than one under active exploitation. The C:H/I:H/A:H triad is somewhat generous for a credential-protection weakness whose primary demonstrated impact is credential exposure (leading to disclosure, then potential lateral escalation); the near-maximal 9.9 should be treated as vendor worst-case pending per-CVE detail. Bottom line: high patch priority because ISE is a high-value identity/policy chokepoint and the vector is remote+low-privilege, but 'critical-but-not-actively-exploited' - schedule the hardening upgrade rather than treat as an emergency zero-day.

A user with a low-privilege authenticated account on the ISE/ISE-PIC administrative or portal surface abuses an insufficiently-protected-credentials weakness to read stored or transmitted secrets (e.g., service/integration or account credentials) they should not see. Because the CVSS scope is changed (S:C), those recovered credentials can be reused to pivot to other systems or components beyond ISE itself, escalating impact. No public exploit code has been identified at the time of analysis; the issues were found through Cisco's internal security review.