CVE-2026-20029
XML Injection in Cisco ISE Licensing Allows Sensitive Data Access
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | identity_services_engine | to 3.2 (exc) |
| cisco | ise_passive_identity_connector | to 3.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could potentially impact compliance with standards and regulations such as GDPR and HIPAA because it allows an authenticated attacker with administrative privileges to access sensitive information that should otherwise be protected. Exposure of sensitive data due to this vulnerability may lead to violations of data protection requirements mandated by these regulations. However, no specific compliance impacts are detailed in the provided resources. [1]
Can you explain this vulnerability to me?
CVE-2026-20029 is a medium-severity XML External Entity (XXE) vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It occurs due to improper parsing of XML data in the web-based management interface. An authenticated remote attacker with administrative privileges can exploit this by uploading a malicious XML file, allowing them to read arbitrary files from the underlying operating system, potentially exposing sensitive information that should be inaccessible even to administrators. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrative credentials to read arbitrary files on the system, potentially exposing sensitive information. This could lead to unauthorized disclosure of confidential data, which may compromise the security of the affected system and any sensitive data it holds. However, the vulnerability does not impact system integrity or availability. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) to fixed software releases. Specifically, apply patches 3.2 Patch 8, 3.3 Patch 8, or 3.4 Patch 4 or later versions, as version 3.5 and later are not vulnerable. There are no workarounds available, so upgrading is the only effective mitigation. Additionally, consult Cisco's upgrade guides and ensure hardware compatibility before applying patches. For further assistance, contact Cisco Technical Assistance Center (TAC). [1]