CVE-2026-20072: ISE information disclosure
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to. This vulnerability exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could exploit this vulnerability by exporting the users. A successful exploit could allow the attacker to view passwords that are normally not visible to administrators.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Cisco ISE deployments using the web-based management interface are exposed when an attacker has an authenticated administrative account with management rights over network users. The issue can disclose information for users outside the attacker's assigned security group.
What does an attacker need to exploit it?
The attacker must be remote, authenticated, and have administrative privileges plus management rights over network users. Exploitation involves exporting users through the management interface.
What information could be disclosed?
A successful exploit can allow the attacker to view passwords that would normally be hidden from administrators, along with sensitive information about network users outside their assigned security group.