Critical Cisco ISE flaws give attackers root and leak credentials

Cisco has patched serious flaws in Identity Services Engine (ISE), the platform many organizations use to control who and what connects to their network. The most severe is a critical remote-code-execution bug that can give an attacker root-level control of the appliance. A second flaw, CVE-2026-20190, is an unauthenticated information-disclosure issue caused by weak authorization checks, letting a remote attacker pull sensitive data, including hashed credentials, that could fuel follow-on attacks and lateral movement. All versions of ISE and ISE-PIC are affected, though which flaws apply varies by release. Cisco has not reported active exploitation, but ISE sits at the heart of network access control.

Check

Identify Cisco ISE and ISE-PIC deployments and their patch levels, restrict access to the management interface to trusted administrators, and review logs for unexpected requests or signs of credential access.

Affected

All versions of Cisco Identity Services Engine (ISE) and ISE-PIC, with applicable flaws varying by release; the unauthenticated information-disclosure bug is tracked as CVE-2026-20190, alongside a critical root-level code-execution flaw.

Fix

Upgrade to ISE 3.3 Patch 11 or 3.4 Patch 6 now; the 3.5 Patch 4 fix is expected in August. Limit management access to trusted networks until then.