Information Disclosure Vulnerability in Cisco Identity Services Engine

CVE-2026-20072

What is CVE-2026-20072?

In Cisco's Identity Services Engine (ISE), a significant vulnerability exists in its web-based management interface. An authenticated remote attacker with administrative privileges can exploit this flaw to gain unauthorized access to sensitive information about network users outside their designated security group. The vulnerability arises from inadequate authorization enforcement on certain files, allowing attackers to export user data that typically remains hidden from administrators. By successfully exploiting this weakness, attackers may be able to view passwords and other confidential information, potentially compromising the security and integrity of the network.

References