Cisco Identity Services Engine CVE-2026-20235

Requires valid administrative credentials on the affected Cisco ISE device (PR:H per CVSS and explicitly stated in the description), so exploitation is limited to attackers who already hold admin-level access or have compromised such an account. No user interaction is needed (UI:N) and the API is network-reachable (AV:N). The vulnerability lies in insufficient validation of user-supplied parameters in API requests; the attacker sends a single crafted API request. Affects Cisco ISE Software versions 3.1 through 3.5 across numerous patch levels; the primary limiting factor is the administrative-credential prerequisite rather than any non-default configuration.

The vendor CVSS of 4.9 (Medium) is a credible ceiling, not an understatement. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N correctly captures a confidentiality-only information-disclosure flaw: network-reachable, low complexity, but gated behind PR:H - the description explicitly requires 'valid administrative credentials.' That PR:H requirement is the dominant risk limiter: an attacker who already holds admin credentials on the ISE node has substantial access, so the marginal gain here is narrow. However, the C:H is meaningful because the disclosed data includes hashed credentials, which feed offline cracking or credential-reuse against other systems - an escalation/lateral-movement primitive rather than a one-off leak. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation; this reads as a targeted, post-authentication data-exposure issue rather than a mass-exploitable entry point. Note a taxonomy tension: CWE-89 (SQL Injection) and the 'SQLi' tag imply injection into the backend DB, yet the impact is strictly read-only (I:N/A:N) info disclosure, consistent with a blind/read SQLi limited to data exfiltration - verify with the Cisco advisory (cisco-sa-ise-inf-disc-LFWvcCu) whether write/modify is truly impossible.

An attacker who has obtained valid ISE administrative credentials (via phishing, reuse, or a lower-privilege foothold) sends a crafted API request with malicious parameter values that are insufficiently validated, injecting into a backend SQL query. The response leaks sensitive data including hashed credentials, which the attacker then cracks or replays to broaden access. No public exploit code is identified at time of analysis.