CVE-2026-20148
EUVD-2026-2296315.04.2026, 17:17
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| cisco | identity_services_engine | 𝑥 < 3.1 |
| cisco | identity_services_engine | 3.1.0 |
| cisco | identity_services_engine | 3.1.0:patch1 |
| cisco | identity_services_engine | 3.1.0:patch10 |
| cisco | identity_services_engine | 3.1.0:patch2 |
| cisco | identity_services_engine | 3.1.0:patch3 |
| cisco | identity_services_engine | 3.1.0:patch4 |
| cisco | identity_services_engine | 3.1.0:patch5 |
| cisco | identity_services_engine | 3.1.0:patch6 |
| cisco | identity_services_engine | 3.1.0:patch7 |
| cisco | identity_services_engine | 3.1.0:patch8 |
| cisco | identity_services_engine | 3.1.0:patch9 |
| cisco | identity_services_engine | 3.2.0 |
| cisco | identity_services_engine | 3.2.0:patch1 |
| cisco | identity_services_engine | 3.2.0:patch2 |
| cisco | identity_services_engine | 3.2.0:patch3 |
| cisco | identity_services_engine | 3.2.0:patch4 |
| cisco | identity_services_engine | 3.2.0:patch5 |
| cisco | identity_services_engine | 3.2.0:patch6 |
| cisco | identity_services_engine | 3.2.0:patch7 |
| cisco | identity_services_engine | 3.2.0:patch8 |
| cisco | identity_services_engine | 3.2.0:patch9 |
| cisco | identity_services_engine | 3.3.0 |
| cisco | identity_services_engine | 3.3.0:patch1 |
| cisco | identity_services_engine | 3.3.0:patch10 |
| cisco | identity_services_engine | 3.3.0:patch2 |
| cisco | identity_services_engine | 3.3.0:patch3 |
| cisco | identity_services_engine | 3.3.0:patch4 |
| cisco | identity_services_engine | 3.3.0:patch5 |
| cisco | identity_services_engine | 3.3.0:patch6 |
| cisco | identity_services_engine | 3.3.0:patch7 |
| cisco | identity_services_engine | 3.3.0:patch8 |
| cisco | identity_services_engine | 3.3.0:patch9 |
| cisco | identity_services_engine | 3.4.0 |
| cisco | identity_services_engine | 3.4.0:patch1 |
| cisco | identity_services_engine | 3.4.0:patch2 |
| cisco | identity_services_engine | 3.4.0:patch3 |
| cisco | identity_services_engine | 3.4.0:patch4 |
| cisco | identity_services_engine | 3.4.0:patch5 |
| cisco | identity_services_engine | 3.5.0 |
| cisco | identity_services_engine | 3.5.0:patch1 |
| cisco | identity_services_engine | 3.5.0:patch2 |
| cisco | identity_services_engine_passive_identity_connector | 𝑥 < 3.1.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch1 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch10 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch2 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch3 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch4 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch5 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch6 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch7 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch8 |
| cisco | identity_services_engine_passive_identity_connector | 3.1.0:patch9 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch1 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch2 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch3 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch4 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch5 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch6 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch7 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch8 |
| cisco | identity_services_engine_passive_identity_connector | 3.2.0:patch9 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch1 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch10 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch2 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch3 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch4 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch5 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch6 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch7 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch8 |
| cisco | identity_services_engine_passive_identity_connector | 3.3.0:patch9 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0:patch1 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0:patch2 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0:patch3 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0:patch4 |
| cisco | identity_services_engine_passive_identity_connector | 3.4.0:patch5 |
| cisco | identity_services_engine_passive_identity_connector | 3.5.0 |
| cisco | identity_services_engine_passive_identity_connector | 3.5.0:patch1 |
| cisco | identity_services_engine_passive_identity_connector | 3.5.0:patch2 |
𝑥
= Vulnerable software versions