CVE-2026-20235

CVE-2026-20235 is an information-disclosure flaw in the API of Cisco Identity Services Engine (ISE), caused by insufficient validation of user-supplied parameters in API requests (CWE-89); ZDI tracks it as XML External Entity processing in the MnT REST LiveLog service. An authenticated, remote attacker who already holds valid administrative credentials can trigger it by sending a crafted API request to an affected device. A successful exploit leaks sensitive information, including hashed credentials that could be cracked or reused in follow-on attacks. Any organization running Cisco ISE that exposes the affected API to administrators is in scope; exploitation requires high privileges (PR:H), which limits practical impact. The flaw is rated 4.9 (medium), is not in CISA KEV, has no known public proof-of-concept, and there are no reports of exploitation in the wild.

What to do: Upgrade Cisco ISE to the fixed release listed in the Cisco PSIRT advisory for CVE-2026-20235 (fixed versions not provided in this data). As an interim mitigation, restrict access to the ISE administration portal and the MnT REST API to trusted management networks and least-privilege administrator accounts. Because hashed credentials can be harvested, review ISE API logs for unexpected or anomalous requests and rotate/monitor administrative and internal user credentials.