Loading story…
Cisco disclosed four independent medium-severity vulnerabilities in Cisco Identity Services Engine (ISE); three also affect Cisco ISE Passive Identity Connector (ISE-PIC). Unauthenticated remote attackers could manipulate endpoint posture status, obtain sensitive configuration information, or trigger reloading of OCSP responder certificate and key material. A separate authenticated XML external entity (XXE) vulnerability could allow reading of certain operating-system files.
Cisco released software updates for all affected releases and stated that no workarounds are available. The flaws are independent, and exposure varies by vulnerability and software version; organizations using ISE or ISE-PIC should identify affected deployments and apply Cisco’s updates promptly.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco released software updates addressing CVE-2026-76439, CVE-2026-76444, CVE-2026-76447, and CVE-2026-76446. Cisco stated that no workarounds are available for any of the four flaws.
Cisco disclosed four independent medium-severity vulnerabilities: unauthenticated posture-status manipulation (CVE-2026-76439), configuration disclosure (CVE-2026-76444), OCSP certificate/key-material reload (CVE-2026-76447), and an authenticated XXE file-read flaw (CVE-2026-76446). Three of the flaws also affect Cisco ISE Passive Identity Connector (ISE-PIC).
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
tools.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed two vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that can allow authenticated attackers to execute malicious code and access sensitive files. The most severe flaw, **`CVE-2026-20147`** with a **CVSS 9.9**, is an authenticated remote code execution issue that can provide user-level operating system access and may be escalated to **root**. A second flaw, **`CVE-2026-20148`** with a **CVSS 4.9**, is an authenticated path traversal vulnerability that can expose files from the underlying operating system.
Jun 29, 2026
Cisco has disclosed and patched a vulnerability (CVE-2026-20029) in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows authenticated attackers with administrative privileges to exploit improper XML parsing in the web-based management interface. By uploading a malicious file, an attacker could read arbitrary files from the underlying operating system, potentially accessing sensitive data that should not be available even to administrators. Cisco has confirmed that there is public proof-of-concept exploit code available, though there is no evidence of active exploitation at this time. The company strongly recommends upgrading to the fixed software versions, as no workarounds are available and mitigations are only temporary. The vulnerability affects all versions of Cisco ISE and ISE-PIC prior to the fixed releases, with specific patches available for versions 3.2, 3.3, and 3.4, while version 3.5 is not vulnerable. Cisco emphasizes the importance of prompt patching to prevent potential exploitation, especially given the availability of exploit code. The flaw is rated with a CVSS base score of 4.9 and is due to improper XML external entity processing (CWE-611).
Jun 29, 2026
Cisco disclosed two vulnerabilities in **Cisco Identity Services Engine (ISE)** and **Cisco ISE Passive Identity Connector (ISE-PIC)**, including the critical remote code execution flaw `CVE-2026-20181` and the high-severity information disclosure flaw `CVE-2026-20190`. Cisco said `CVE-2026-20181` carries a CVSS score of **9.1** and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated **7.5**, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks. The affected software includes all releases prior to **3.3**, versions before **3.3 Patch 11** in release 3.3, versions before **3.4 Patch 6** in release 3.4, and versions before **3.5 Patch 4** in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Jun 29, 2026