Search: “identity services engine”

246 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 418 Vulnerability 411 Malware 289 Phishing & fraud 289 Data breach 263 Policy & legal 168 Exploit / PoC 156 Threat actor 137 Industry 131 AI tools & infra 48 AI safety & security 44 Advisory 31 Research 29 AI industry 12

SeverityAll critical 959 high 640 medium 459 low 246 info 157

ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability

Cisco Identity Services Engine's PatchUpdateListener has an authenticated directory traversal (CVE-2026-20148, CVSS 4.9) enabling sensitive information disclosure.

ZDI advisory ZDI-26-582 describes a directory traversal information disclosure vulnerability in the PatchUpdateListener component of Cisco Identity Services Engine. Remote attackers can disclose sensitive information, but valid authentication is required to exploit the flaw. ZDI assigned a CVSS rating of 4.9 and CVE-2026-20148.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-20148

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.

Cisco Security Advisoriesupdated 06:19 UTC · 1h agofirst Sep 16, 16:00 UTC · 15h agoAdvisory 16 sources

Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco patched an ISE API flaw letting an authenticated administrator view sensitive data including hashed credentials via crafted API requests.

A vulnerability in the Cisco Identity Services Engine API allows an authenticated remote attacker with valid administrative credentials to view sensitive information, including hashed credentials usable in future attacks. The flaw is caused by insufficient validation of user-supplied API request parameters. Cisco has released software updates.

Cisco Security Advisoriesupdated 06:19 UTC · 1h agofirst Sep 16, 16:00 UTC · 15h agoAdvisory 16 sources

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Cisco patched a reflected XSS in the ISE management interface allowing unauthenticated attackers to execute script via crafted links.

A reflected cross-site scripting vulnerability in the web-based management interface of Cisco Identity Services Engine lets an unauthenticated remote attacker execute arbitrary script in the context of the interface. Exploitation requires persuading a user to click a crafted link due to improper input validation. Cisco has released software updates.

Cisco Security Advisoriesupdated 06:19 UTC · 1h agofirst Sep 16, 16:00 UTC · 15h agoAdvisory 16 sources