CVE-2026-20190: cisco cisco identity services engine software Improper Authorization

Vulnerability summary

CVE-2026-20190 is a high (CVSS 7.5) Improper Authorization vulnerability in cisco cisco identity services engine software. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.8% of scored vulnerabilities.

Timeline

1. 17-06-2026
   PublishedVulnerability first disclosed.
2. 17-06-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.