CVE-2026-20146

Analyzed Analyzed - Analysis Complete

Path Traversal in Cisco Identity Services Engine

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: Cisco Systems, Inc.

Description

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.  This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files or delete arbitrary files on the affected system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-20146

EUVD

EUVD-2026-44716

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	to 3.3.0 (exc)
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine_passive_identity_connector	3.5.0
cisco	identity_services_engine_passive_identity_connector	3.5.0
cisco	identity_services_engine_passive_identity_connector	3.5.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.5.0
cisco	identity_services_engine_passive_identity_connector	3.3.0
cisco	identity_services_engine_passive_identity_connector	3.4.0
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	to 3.3.0 (exc)
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.4.0
cisco	identity_services_engine	3.5.0
cisco	identity_services_engine	3.5.0
cisco	identity_services_engine	3.5.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.5.0
cisco	identity_services_engine	3.3.0
cisco	identity_services_engine	3.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). An authenticated remote attacker with admin credentials can send a crafted HTTP request to read or delete arbitrary files on the underlying system due to improper input validation.

Detection Guidance

Detecting this vulnerability requires checking for Cisco ISE or ISE-PIC systems with outdated software versions. Review installed versions against Cisco's advisory to identify affected releases. Monitor network traffic for unusual HTTP requests targeting ISE administrative interfaces.

Impact Analysis

An attacker could access sensitive files or delete critical system files, potentially disrupting services, exposing confidential data, or causing system instability. Administrative access is required for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must patch systems to maintain compliance.

Mitigation Strategies

Immediately upgrade Cisco ISE and ISE-PIC to the fixed software releases for versions 3.3, 3.4, or 3.5 as specified in Cisco's advisory. Ensure no unauthorized administrative accounts exist and restrict access to administrative interfaces.

Hi! I’m here to help you understand CVE-2026-20146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70