ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
ZDI detailed CVE-2026-20235, an authenticated XML external entity information disclosure flaw (CVSS 4.9) in Cisco Identity Services Engine.
ZDI-26-718 describes an XXE vulnerability in Cisco Identity Services Engine's MnTRESTLivelogService that allows remote, authenticated attackers to disclose sensitive information. The flaw is tracked as CVE-2026-20235 and carries a CVSS score of 4.9. Exploitation requires valid credentials.
- XXE in MnTRESTLivelogService enables authenticated information disclosure
- CVSS 4.9; valid credentials required to exploit
- CVEs
- CVE-2026-20235
- Vendors
- CiscoZero Day Initiative
- Products
- Cisco Identity Services Engine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20235 | Authenticated XXE Information Disclosure in Cisco Identity Services Engine (ISE) API | 4.9 | — |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.