CVE-2026-20193: Cisco Identity Services Engine Authentication Bypass Vulnerability
A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive information on an affected device. This vulnerability is due to improper role-based access control (RBAC) permissions on the RADIUS Policy API endpoints. An attacker could exploit this vulnerability by bypassing the web-based management interface and directly calling an affected endpoint. A successful exploit could allow the attacker to gain unauthorized read access to sensitive RADIUS Policy details that are restricted for their role.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20193?
CVE-2026-20193 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive information.
How do I fix CVE-2026-20193?
To mitigate CVE-2026-20193, it is recommended to update to the latest version of Cisco Identity Services Engine that addresses this vulnerability.
Who is affected by CVE-2026-20193?
CVE-2026-20193 affects authenticated users with read-only Administrator privileges on Cisco Identity Services Engine devices.
What could an attacker exploit in CVE-2026-20193?
An attacker could exploit CVE-2026-20193 to bypass authentication and access sensitive data on an affected Cisco Identity Services Engine.
Is CVE-2026-20193 related to any specific Cisco products?
Yes, CVE-2026-20193 specifically affects the Cisco Identity Services Engine, particularly its RADIUS Policy API endpoints.