CVE-2026-20235 Cisco Identity Services Engine Information Disclosure Vulnerability
An authenticated attacker can exploit insufficient API validation to view sensitive information, including hashed credentials, on Cisco ISE devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-20235?
CVE-2026-20235 is a medium-severity SQL injection vulnerability in Cisco Identity Services Engine Software, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.
Weakness: CWE-89
Which versions are affected by CVE-2026-20235?
How do I fix CVE-2026-20235?
No fix has been published for CVE-2026-20235 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-20235 being exploited?
There is no known exploitation of CVE-2026-20235 in the wild and no public exploit code.
Sources
Also known as GHSA-728x-68rc-w7wm.