ZDI-26-019: Cisco Identity Services Engine getSpecificPLRfromAuthCode XML External Entity Processing Information Disclosure Vulnerability
Published Jan 9, 2026
·Updated
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20029.
Affected Software
1 affected component
Cisco Identity Services Engine
Event History
Jan 9, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-26-019?
ZDI-26-019 is classified as a medium severity vulnerability.
2
How do I fix ZDI-26-019?
To fix ZDI-26-019, ensure that your Cisco Identity Services Engine is updated to the latest patched version.
3
What type of information can be disclosed due to ZDI-26-019?
ZDI-26-019 may allow attackers to disclose sensitive information related to authentication and configuration.
4
Is authentication required to exploit ZDI-26-019?
Yes, authentication is required to exploit the ZDI-26-019 vulnerability.
5
Which products are affected by ZDI-26-019?
The Cisco Identity Services Engine is the affected product for the ZDI-26-019 vulnerability.