API Vulnerability in Cisco Identity Services Engine Allows Information Disclosure

CVE-2026-20235

What is CVE-2026-20235?

A vulnerability in the API of Cisco Identity Services Engine (ISE) permits authenticated remote attackers to access sensitive data from affected devices. This issue arises from inadequate validation of user-supplied parameters in API requests. An attacker with valid administrative credentials could initiate a specially crafted API request that exploits this vulnerability, potentially allowing access to hashed credentials and other sensitive information. This poses a risk of further attacks leveraging the compromised data. Ensuring secure API practices is critical to mitigating such vulnerabilities.

References