Cisco Identity Services Engine Software up to 3.5.0 HTTP path traversal

Summaryinfo

A vulnerability was found in Cisco Identity Services Engine Software and ISE Passive Identity Connector and classified as critical. This issue affects some unknown processing of the component HTTP Handler. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-20181. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Identity Services Engine Software and ISE Passive Identity Connector. It has been rated as critical. Affected by this issue is an unknown code of the component HTTP Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2026-20181 since 10/08/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/18/2026). The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability scanner Nessus provides a plugin with the ID 321492 (Cisco Identity Services Engine (cisco-sa-ise-multi-G5WP8vv)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (321492), EUVD (EUVD-2026-37748) and CERT Bund (WID-SEC-2026-1989). Once again VulDB remains the best source for vulnerability data.

Affected

• Cisco Identity Services Engine (ISE)

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software
• ISE Passive Identity Connector

Version

• 3.1.0
• 3.1.0 p1
• 3.1.0 p2
• 3.1.0 p3
• 3.1.0 p4
• 3.1.0 p5
• 3.1.0 p6
• 3.1.0 p7
• 3.1.0 p8
• 3.1.0 p9
• 3.1.0 p10
• 3.1.0 p11
• 3.2.0
• 3.2.0 p1
• 3.2.0 p2
• 3.2.0 p3
• 3.2.0 p4
• 3.2.0 p5
• 3.2.0 p6
• 3.2.0 p7
• 3.3.0
• 3.4.0
• 3.5.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion