CVE-2026-20190

This issue means someone on the internet may be able to ask the Cisco access-control system for a resource it shouldn’t reveal, and the system may accidentally respond with sensitive details. A common risk with information leaks is that the leaked data—like hashed login credentials—can help an attacker plan the next step. Think of it like a receptionist who shouldn’t hand out confidential folders, but occasionally does when someone asks the right question in the wrong way.

This matters to you if you use or run Cisco Cisco Identity Services Engine Software, Cisco Cisco ISE Passive Identity Connector (Cisco ISE-PIC), or the broader “cisco identity services engine” and “cisco identity services engine passive identity connector” products. Because the flaw can be reached by an unauthenticated remote attacker, it’s relevant even if you don’t have special user accounts exposed to the public internet. If you don’t use these Cisco products, you’re likely not affected.

Set aside time to fix this in the near term (not weeks from now). The estimated probability of exploitation over the next 30 days is low, and there is no confirmation that it’s being exploited in the wild, but a public exploit exists and the issue can expose sensitive information, including hashed credentials. With an information leak, “waiting it out” can increase the chance attackers use the exposed data later.

1. Identify exposure

• Confirm whether you run “Cisco Cisco Identity Services Engine Software” and/or “Cisco Cisco ISE Passive Identity Connector (ISE-PIC)” (also referred to as “cisco identity services engine” / “cisco identity services engine passive identity connector”).
• Determine the exact software version(s) and deployment layout (including any passive identity connector components).

2. Patch/upgrade

• Apply Cisco’s recommended fixed versions for CVE-2026-20190 for both Cisco ISE and Cisco ISE-PIC.
• Reboot/redeploy as required by the vendor after upgrading.

3. Compensating controls if patching is delayed

• Restrict network reachability: ensure the affected ISE/ISE-PIC endpoints are not exposed to the public internet.
• Allow only required source networks (for example, only your internal subnets or approved management networks).
• If ISE services are accessed through a reverse proxy or load balancer, confirm that access controls are correctly enforced before traffic reaches ISE.

4. Validate

• After patching, verify that the system behaves normally (authentication, identity services, and any dependent integrations still work).
• Confirm you have the patched/fixed code running on each affected node (ISE and ISE-PIC).

5. Monitor for follow-on signs

• Since the risk includes exposure of hashed credentials, monitor for:
  • Unexpected authentication attempts against related systems/accounts.
  • New logins or password-reset activity that doesn’t match your users’ behavior.
  • Unusual outbound connections or lateral movement attempts from the ISE/ISE-PIC environment.
• Review relevant ISE/operational logs for patterns consistent with “crafted traffic” probing.

6. Incident readiness (if you suspect exposure)

• If you find suspicious activity, treat it as a possible credential exposure event: investigate account activity and consider rotating credentials where appropriate (your security/IT team can advise on the safest approach).

Severity and impact: This is an information disclosure issue in Cisco ISE and Cisco ISE-PIC that could allow an unauthenticated remote attacker to view sensitive information, including hashed credentials. The underlying cause is improper authorization checks when accessing a resource.

Attack vector: An attacker can send crafted network traffic to an affected device over the network. No valid user login is required to trigger the leak.

Exploitation status: According to the provided press context, there is no confirmed exploitation in the wild. However, a public exploit is available, which increases the risk that opportunistic attacks could emerge.

EPSS / KEV meaning (in plain terms): EPSS is an estimate of how likely exploitation is over a time window; here it is 0.4% over the next 30 days (low likelihood). KEV (CISA Known Exploited Vulnerabilities) indicates vulnerabilities known to be exploited in the wild; for this CVE, KEV status is “no,” meaning it has not been listed as actively exploited by CISA at the time of the provided info.

Nuclei detection: A Nuclei detection template exists: no, so automated scanning coverage may be less widespread, though manual/public tooling still exists.