Unauthenticated improper access control in Cisco ISE and ISE-PIC (CVE-2026-20192)
Cisco's 2026-09-16 hardening advisory states one of the grouped flaws is being exploited and the Canadian Centre for Cyber Security issued alert AL26-021 on 2026-09-17 confirming exploitation, so ISE 3.1 and 3.2 deployments left on affected patch levels remain exposed to an unauthenticated network attack.
CVE-2026-20192 groups improper access control (CWE-284) flaws in Cisco Identity Services Engine and ISE Passive Identity Connector fixed in Cisco's September 2026 hardening release. It is rated CVSS 10.0 with no authentication or user interaction required, allowing a remote attacker to bypass access controls on the appliance that governs network access for the whole organization.
Affected: Cisco Identity Services Engine 3.1.0 through 3.1.0 p6; Cisco Identity Services Engine 3.2.0 through 3.2.0 p2; Cisco ISE Passive Identity Connector (ISE-PIC) per the hardening advisory
How to Test
Check the ISE/ISE-PIC release and patch level in the admin portal or CLI: 3.1.0 with patches 1–6 and 3.2.0 with patches 1–2 are listed as affected. Review admin portal and API access logs and the ISE audit/operations reports for unexpected administrative sessions, new admin accounts, or configuration changes originating from unfamiliar source addresses; the Canadian Cyber Centre alert AL26-021 provides additional detection advice.
How to Patch
Apply Cisco's September 2026 ISE hardening release (advisory cisco-sa-hardening-ise-XU5EwX5T) to the 3.1 and 3.2 trains; Cisco states no workarounds are available, so if patching must wait, restrict network access to the ISE administrative interfaces to trusted management networks.