Cisco ISE Vulnerability With Public PoC: CVE-2026-20029

Cisco has released security updates to fix a medium-severity vulnerability in its Identity Services Engine (Cisco ISE) and ISE Passive Identity Connector (ISE-PIC) products after a public proof-of-concept (PoC) exploit became available. The issue could allow attackers with administrative access to read sensitive files from the underlying operating system.

The vulnerability highlights ongoing risks in widely used enterprise identity and access management solutions, especially when flaws are disclosed publicly. Cisco customers are strongly advised to apply the latest patches to reduce exposure.

The flaw is tracked as CVE-2026-20029 and has a CVSS score of 4.9, placing it in the medium-severity category. Despite the moderate score, the availability of public exploit code increases the overall risk, particularly in environments where administrative accounts may already be compromised.

According to Cisco’s official security advisory, the vulnerability exists in the licensing feature of Cisco ISE and ISE-PIC. The root cause is improper parsing of XML files processed by the web-based management interface.

Cisco explained that an attacker could exploit the issue by uploading a specially crafted malicious file to the application. While the attacker must already have valid administrative credentials, successful exploitation could allow them to read arbitrary files from the operating system.

Importantly, Cisco noted that these files should be restricted even for administrators, making this a violation of expected access controls and privilege boundaries.

Cisco ISE is widely used by enterprises to manage network access control (NAC), identity authentication, and policy enforcement across corporate networks. Any weakness in such a critical security platform can have serious implications.

If exploited, the vulnerability could allow attackers to access:

• Configuration files

• System-level information

• Sensitive operational data

Although Cisco has stated that there is no evidence of active exploitation in the wild, the presence of a public PoC exploit significantly lowers the barrier for attackers. In real-world scenarios, threat actors often chain such vulnerabilities with stolen or reused credentials to escalate attacks.

Cisco confirmed that multiple versions of ISE and ISE-PIC are affected. The following breakdown shows which releases are vulnerable and how to remediate them:

• Cisco ISE or ISE-PIC earlier than Release 3.2
  → Upgrade to a fixed release

• Cisco ISE or ISE-PIC Release 3.2
  → Apply Patch 8

• Cisco ISE or ISE-PIC Release 3.3
  → Apply Patch 8

• Cisco ISE or ISE-PIC Release 3.4
  → Apply Patch 4

• Cisco ISE or ISE-PIC Release 3.5
  → Not vulnerable

Cisco has clearly stated that there are no workarounds available. Applying the official patches is the only effective mitigation.

The vulnerability was discovered and responsibly reported by Bobby Gould of the Trend Micro Zero Day Initiative (ZDI). Cisco credited the researcher for identifying the flaw and coordinating disclosure.

Responsible reporting plays a key role in helping vendors address security issues before they are widely exploited, although the public release of PoC code increases urgency for patching.