Cisco ISE CVE-2026-20285

Requires valid, authenticated access to the ISE/ISE-PIC web-based management interface with an administrator-tier account that lacks full Administrator permissions (PR:L); exploitation is a single crafted HTTP request to the affected configuration page. The limiting factors are strong: an attacker must already possess working management-console credentials, and the achievable effect is bounded to modifying file descriptions on one specific page - no confidentiality or availability impact and no escalation. This is not exploitable pre-authentication or against a defaulted/unauthenticated attack surface.

This is a low-severity, high-friction issue that does not warrant priority patching in isolation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is network-reachable and low-complexity, but PR:L plus a strictly integrity-only impact (C:N/I:L/A:N) caps the real-world risk. The description explicitly states valid Administrator credentials are required and the only achievable effect is modifying descriptions of files on a specific page - a trivial, non-escalating integrity change. There is a notable internal tension worth flagging: the prose says 'valid Administrator credentials' (suggesting a privileged account) while the CVSS encodes PR:L (low privilege), consistent with the root cause being missing server-side validation of Administrator permissions - i.e., a lower-tier admin role reaching a function reserved for full administrators; the PR:L rating is the defensible reading. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. Compared with far more serious ISE siblings (unauthenticated SQLi CVE-2026-20247 I:H, or authed C:H SQLi/traversal in the same product family), this is at the bottom of the ISE severity stack and should be batched into routine patch cycles rather than treated as an emergency.

A user holding a limited (non-full) administrator role in the ISE/ISE-PIC web console submits a crafted HTTP request to a configuration endpoint that fails to server-side-validate full Administrator permissions, and alters the descriptions of files on a specific management page. The impact is confined to cosmetic/metadata integrity of those file descriptions - no data disclosure, no service disruption, and no privilege escalation. No public exploit code is identified at time of analysis.