Path Traversal Vulnerability in Cisco Identity Services Engine and Passive Identity Connector

CVE-2026-20146

What is CVE-2026-20146?

A newly identified vulnerability in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector allows authenticated remote attackers to conduct path traversal attacks. This security flaw arises from inadequate validation of user input, enabling attackers to craft specific HTTP requests to access or manipulate sensitive files on the system. With valid administrative credentials, an attacker could potentially exploit this vulnerability to either read or delete arbitrary files, posing significant risks to data integrity and confidentiality.

References