Cisco has released a security advisory addressing a critical vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could allow authenticated attackers with administrative privileges to access sensitive information on affected systems.
The vulnerability, tracked as CVE-2026-20029, stems from improper XML parsing in the web-based management interface and carries a CVSS score of 4.9.
The flaw exists in the licensing features of Cisco ISE and ISE-PIC products. Attackers can exploit this vulnerability by uploading a malicious file to the application and leveraging an XML External Entity (XXE) injection to read arbitrary files from the underlying operating system.
This includes sensitive data that should remain inaccessible, even to administrators. To execute the attack, threat actors must possess valid administrative credentials, limiting the attack surface to insiders or those who have compromised administrative accounts.
Cisco’s advisory notes that proof-of-concept exploit code is already available for this vulnerability, though the company is currently unaware of any active malicious exploitation in the wild.
The vulnerability affects all versions of Cisco ISE and ISE-PIC, regardless of device configuration, making it a broad concern for organizations that rely on these identity management solutions.
The company has classified this as a medium-severity issue and has released patches across its supported product versions.
Organizations running Cisco ISE versions earlier than 3.2 are urged to migrate immediately to a fixed release.
Users of version 3.2 should upgrade to Patch 8; users of version 3.3 need Patch 8. Version 3.4 users require Patch 4, and version 3.5 is not vulnerable. No workarounds are available, leaving patching as the only remediation option.
This vulnerability was responsibly disclosed by Bobby Gould of Trend Micro Zero Day Initiative and highlights the ongoing risks associated with XML processing in enterprise security appliances.
Organizations managing identity infrastructure should prioritize patching, particularly for environments with multiple ISE deployments.
| Product Version | Status | Fixed Release |
|---|---|---|
| Earlier than 3.2 | Vulnerable | Migrate to fixed release |
| 3.2 | Vulnerable | 3.2 Patch 8 |
| 3.3 | Vulnerable | 3.3 Patch 8 |
| 3.4 | Vulnerable | 3.4 Patch 4 |
| 3.5 | Not Vulnerable | No patch required |
Advisory Details:
- CVE ID: CVE-2026-20029
- CVSS Base Score: 4.9 (Medium)
- CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
- Cisco Bug ID: CSCwq79739
- Published: January 7, 2026
- Reference: cisco-sa-ise-xxe-jWSbSDK
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The vulnerability, tracked as CVE-2026-20029, stems from improper XML parsing in the web-based management interface and carries a CVSS score of 4.9.){kind=link}