Cisco Identity Services Engine
CVE-2026-20192
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
What this means for your business
- It affects Cisco Identity Services Engine. It matters if your company, or a supplier that handles your data, runs it.
- An attacker can use it remotely, over a network, without a login, and without anyone at your company clicking anything.
What to do
- 1Check whether your company or your suppliers run Cisco Identity Services Engine, and which version. The affected versions are listed further down this page.
- 2If you do, apply the vendor's fix. A patch or vendor advisory has been published.
Fastnexa security experts
Not sure if your company is exposed to CVE-2026-20192?
Tell us where you run Cisco Identity Services Engine and a Fastnexa penetration tester will check whether this flaw, or others like it, can be used against your websites, apps and network.
The full test is free for our first 10 founding clients until 31 December 2026. See the offer
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Scoring
- CVSS
- 10.0 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness
- CWE-284
- Assigned by
- psirt@cisco.com
Dates
- Published
- 2026-09-16
- Last modified
- 2026-09-28
- Sources
- NVD
Affected products
- Cisco Identity Services Engine3.1.0 - 3.3.0, 3.3.0, 3.4.0, 3.5.0
- Cisco Identity Services Engine Passive Identity Connector3.1.0 - 3.3.0, 3.3.0, 3.4.0
As listed in the NVD configuration data. Not a statement about your estate.
Coverage
- AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460Canadian Centre for Cyber Security · 2026-09-17