ZDI-26-580: Cisco Identity Services Engine Missing Authentication for Critical Function Information Disclosure Vulnerability
The vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-20190.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-580?
The severity of ZDI-26-580 has been assigned a CVSS rating of 7.5.
How do I fix ZDI-26-580?
To fix ZDI-26-580, users should apply the security patches provided by Cisco for the Identity Services Engine.
Who is affected by ZDI-26-580?
ZDI-26-580 affects installations of Cisco Identity Services Engine that have not been updated to address the vulnerability.
What type of vulnerability is ZDI-26-580?
ZDI-26-580 is an information disclosure vulnerability that allows remote attackers to access sensitive information.
Is authentication required to exploit ZDI-26-580?
No, authentication is not required to exploit ZDI-26-580, making it particularly concerning.