CVE-2026-20072
ISE information disclosure
Severity
Medium 4.9
CVSS 3.1
Exploited
Not listed
EPSS
0.004
31.0th percentile
Discovered by
Third party
Vendor-published field
Published
Sep 16, 2026
Assigned by cisco
Description
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to. This vulnerability exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could exploit this vulnerability by exporting the users. A successful exploit could allow the attacker to view passwords that are normally not visible to administrators.
Weakness: CWE-863
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine (ISE) | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Identity Services Engine Software