CVE-2026-20029: Cisco Identity Services Engine Software · XML External Entity (XXE)
Affects Cisco Identity Services Engine SoftwareSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 6.0% chance of exploitation in 30 days – higher than 93% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CiscoCisco Identity Services Engine Software | Affected
| Fixed in– |
AI-suggested
European organizations should implement the following specific mitigations: 1) Immediately restrict administrative access to Cisco ISE management interfaces using network segmentation, VPNs, and strict access control lists to limit exposure. 2) Enforce strong multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise. 3) Monitor and audit administrative activities and file uploads to detect suspicious behavior indicative of exploitation attempts. 4) Apply the latest Cisco ISE patches and updates as soon as they become available; monitor Cisco security advisories closely. 5) Consider deploying Web Application Firewalls (WAFs) or XML input validation proxies to detect and block malicious XML payloads targeting the management interface. 6) Conduct regular security assessments and penetration tests focusing on administrative interfaces and XML processing components. 7) Educate administrators on the risks of credential compromise and safe handling of administrative privileges. These targeted actions go beyond generic advice by focusing on access restriction, monitoring, and proactive patch management specific to this vulnerability's attack vector and requirements.
Description
A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information. This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application. A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators. To exploit this vulnerability, the attacker must have valid administrative credentials.