CVE-2026-20287

CVE-2026-20287 covers multiple improper privilege management flaws (CWE-269) in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC), discovered during a comprehensive internal security review by Cisco's engineering teams and addressed in a software hardening release. The CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates the flaws can be triggered over the network without user interaction, but only by an attacker who already holds high privileges on the system, such as an administrative or similarly privileged account. Successful exploitation yields high confidentiality and integrity impact — unauthorized access to and modification of privileged functionality or identity data — with no availability impact, for a medium severity score of 6.5. Any organization running Cisco ISE or ISE-PIC is potentially affected, though Cisco has not published specific affected or fixed version ranges in the available data. No public proof-of-concept or CISA KEV listing exists for this CVE and no exploitation of it is known, but Cisco has separately warned of an actively exploited ISE zero-day authentication bypass (CVSS 10.0), which raises the urgency of patching ISE deployments.

What to do: Upgrade Cisco ISE and ISE-PIC to the fixed versions named in Cisco's advisory for CVE-2026-20287 (the software hardening release), as no version ranges appear in the available data. Restrict administrative access to ISE/ISE-PIC management interfaces to trusted management networks, and audit privileged accounts and configuration-change logs for unexpected privilege changes. Because Cisco has also warned of a separate actively exploited zero-day ISE auth bypass, treat ISE patching as urgent and verify no ISE admin or API interfaces are reachable from untrusted networks.