Path Traversal Vulnerability in Cisco ISE and Cisco ISE-PIC
CVE-2026-20148

4.9MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Identity Services Engine Software
Cisco Ise Passive Identity Connector
Vendor
CVE Published:
15 April 2026

Badges

👾 Exploit Exists

What is CVE-2026-20148?

A vulnerability exists within Cisco ISE and Cisco ISE-PIC that allows authenticated remote attackers to conduct path traversal attacks. This situation stems from inadequate validation of user-provided input, enabling attackers to craft specific HTTP requests that can manipulate file paths on the server. If successfully executed, these attacks permit access to sensitive files on the system's underlying operating environment, posing serious security risks for organizations utilizing these Cisco products.

Affected Version(s)

Cisco Identity Services Engine Software 3.1.0

Cisco Identity Services Engine Software 3.1.0 p1

Cisco Identity Services Engine Software 3.1.0 p3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.