CVE-2026-20287 is a medium severity vulnerability in Cisco Identity Services Engine (ISE) Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper privilege management issues that could allow elevated privileges under certain conditions. This vulnerability was identified during Cisco's internal security review and is categorized under CWE-269. The CVSS 3.1 base score is 6.5, indicating a moderate impact primarily on confidentiality and integrity. No public exploits are known, and no patch or remediation details are provided in the available data.
CVE-2026-20286 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It allows an authenticated remote attacker with valid Administrator credentials to modify parts of the device configuration through the web-based management interface due to improper server-side authorization validation. The attacker can submit crafted HTTP requests to change descriptions of files on a specific page. No confidentiality or availability impact is reported.
CVE-2026-76438 is a medium severity vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software. It allows an authenticated remote attacker with low privileges to alter device configurations due to missing authorization checks. Exploitation requires sending a crafted HTTP request and does not impact confidentiality or availability but can impact integrity by unauthorized configuration changes.
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to.
This vulnerability exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could exploit this vulnerability by exporting the users. A successful exploit could allow the attacker to view passwords that are normally not visible to administrators.
CVE-2026-76446 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper restriction of XML external entity references in an API, which could allow an authenticated remote attacker to read specific files on the underlying operating system with the permissions of the affected process.
CVE-2026-20071 is a vulnerability in Cisco Identity Services Engine (ISE) Software affecting versions 3.1.0 through 3.5.0. It involves an authentication bypass in the SSID bring-your-own-device (BYOD) onboarding workflow, allowing an unauthenticated adjacent attacker to hijack another user's onboarding session and access protected 802.1X networks. The issue arises from insufficient authentication checks during user onboarding, enabling session takeover via spoofing and redirection to the guest web portal. The CVSS score is 3.8, indicating low severity.
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read or modify data in the underlying database.
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device.
This vulnerability exists because the affected software does not properly validate directory traversal character sequences in a user-supplied file path during the upload process. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to write files to an arbitrary location on the affected system.
CVE-2026-76448 is a medium severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It allows an authenticated remote attacker with administrative credentials to inject arbitrary SQL or HQL commands due to insufficient input validation in certain APIs. Successful exploitation could enable unauthorized viewing or modification of database data. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE software. No patch information is provided in the input data.
CVE-2026-76434 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper limitation of a pathname to a restricted directory (path traversal) in the certificate import functionality of the web-based management interface. An authenticated attacker with administrative credentials can exploit this flaw to read arbitrary files on the affected system, potentially exposing sensitive information.
A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.
This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device.
This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-20290 is a medium severity vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software's Snort 2 Detection Engine. It involves improper validation of SSL/TLS certificates during parsing, which can be exploited by an unauthenticated remote attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS).
A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.
CVE-2026-76449 is a medium severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). It allows an authenticated remote attacker with administrative credentials to inject arbitrary SQL or HQL commands via insufficiently validated user input in affected APIs. Successful exploitation could enable unauthorized modification of database data. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE software.
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-20309 is a reflected cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). It allows an unauthenticated remote attacker to inject malicious scripts by persuading a user to click a crafted link. The vulnerability arises from improper validation of user-supplied input in the interface. Successful exploitation could lead to execution of arbitrary script code in the context of the interface and potential access to sensitive browser-based information. The vulnerability affects specific versions of Cisco ISE software.
A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database.
This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76433 is a medium severity vulnerability in Cisco Identity Services Engine Software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It involves improper limitation of a pathname to a restricted directory, allowing an unauthenticated remote attacker to perform a path traversal attack via the client provisioning download feature. Exploitation could lead to unauthorized access to protected files, potentially exposing sensitive information. No authentication is required to exploit this vulnerability.