Loading story…
Cisco has disclosed and patched a vulnerability (CVE-2026-20029) in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows authenticated attackers with administrative privileges to exploit improper XML parsing in the web-based management interface. By uploading a malicious file, an attacker could read arbitrary files from the underlying operating system, potentially accessing sensitive data that should not be available even to administrators. Cisco has confirmed that there is public proof-of-concept exploit code available, though there is no evidence of active exploitation at this time. The company strongly recommends upgrading to the fixed software versions, as no workarounds are available and mitigations are only temporary.
The vulnerability affects all versions of Cisco ISE and ISE-PIC prior to the fixed releases, with specific patches available for versions 3.2, 3.3, and 3.4, while version 3.5 is not vulnerable. Cisco emphasizes the importance of prompt patching to prevent potential exploitation, especially given the availability of exploit code. The flaw is rated with a CVSS base score of 4.9 and is due to improper XML external entity processing (CWE-611).
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
In its response to CVE-2026-20029, Cisco PSIRT stated it was not aware of any malicious use of the vulnerability in the wild at the time of disclosure. This assessment was repeated across subsequent coverage of the advisory and patch release.
Cisco disclosed CVE-2026-20029 in a security advisory and released software updates for affected ISE and ISE-PIC versions. Cisco said the issue stems from improper XML parsing in the web-based management interface and advised customers to upgrade because no effective workaround exists.
Public proof-of-concept exploit code was released for CVE-2026-20029, increasing the risk that attackers could abuse the file-read vulnerability in Cisco ISE and ISE-PIC. Multiple reports noted that the PoC was available before or at the time Cisco issued its advisory.
Bobby Gould of Trend Micro's Zero Day Initiative discovered and reported CVE-2026-20029, an improper XML parsing vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw allows authenticated administrators to read arbitrary sensitive files from the underlying operating system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed two critical vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that allow unauthenticated remote attackers to execute arbitrary code on the underlying operating system with **root privileges**. The flaws, tracked as `CVE-2025-20281` and `CVE-2025-20282`, are independent issues, meaning exploitation of one is not required to exploit the other. `CVE-2025-20281` affects Cisco ISE and ISE-PIC **version 3.3 and later**, while `CVE-2025-20282` affects **version 3.4 only**; Cisco said **version 3.2 and earlier are not affected**. Cisco also warned that `CVE-2025-20282` can enable arbitrary file upload and execution on vulnerable devices. Patches have been released, and organizations running affected deployments have been urged to update immediately.
Jun 29, 2026
Cisco disclosed four independent medium-severity vulnerabilities in Cisco Identity Services Engine (ISE); three also affect Cisco ISE Passive Identity Connector (ISE-PIC). Unauthenticated remote attackers could manipulate endpoint posture status, obtain sensitive configuration information, or trigger reloading of OCSP responder certificate and key material. A separate authenticated XML external entity (XXE) vulnerability could allow reading of certain operating-system files. Cisco released software updates for all affected releases and stated that no workarounds are available. The flaws are independent, and exposure varies by vulnerability and software version; organizations using ISE or ISE-PIC should identify affected deployments and apply Cisco’s updates promptly.
Sep 25, 2026
Cisco disclosed two vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that can allow authenticated attackers to execute malicious code and access sensitive files. The most severe flaw, **`CVE-2026-20147`** with a **CVSS 9.9**, is an authenticated remote code execution issue that can provide user-level operating system access and may be escalated to **root**. A second flaw, **`CVE-2026-20148`** with a **CVSS 4.9**, is an authenticated path traversal vulnerability that can expose files from the underlying operating system.
Jun 29, 2026