VulnSocial

CVE-2026-20148Patch(cisco / identity_services_engine)

LOWCVSS 4.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch cisco identity_services_engine systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.

cisco CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • identity_services_engine
  • identity_services_engine_passive_identity_connector

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-04-16); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
cisco
Products
identity_services_engineidentity_services_engine_passive_identity_connector

5 versions affected across 2 products

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-16: 2Mentions · 2026-04-23: 1Patch / Workaround · 2026-04-16: 1Patch / Workaround · 2026-04-23: 1Technical Details · 2026-04-16: 2Technical Details · 2026-04-23: 104-1604-23
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-04-162
Disclosure1Patch1
2026-04-231
Patch1
Full discourse3 posts
  • にゃん☆たく/takumi.a@taku888infinity
    Patch

    うわーいっぱいでてるるるるる Cisco Security Advisories https://sec.cloudapps.cisco.com/security/center/publicationListing.x CVE-2026-20184 Cisco Webex Services Certificate Validation Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL CVE-2026-20147　CVE-2026-20148 Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ CVE-2026-20180　CVE-2026-20186 Cisco Identity Services Engine Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv 【セキュリティ ニュース】「Cisco ISE」に複数の深刻な脆弱性 - 一部修正パッチを準備中（1ページ目 / 全2ページ）：Security NEXT https://www.security-next.com/183510

    Post summary

    The post lists several Cisco CVEs with links to advisories and notes that patches are being prepared, focusing on remediation rather than exploitation.

    000421.3K
    11.7K followersView on X
  • iototsecnews@iototsecnews
    Patch

    Cisco ISE／ISE-PIC の脆弱性 CVE-2026-20147 が FIX：認証済みフル RCE の恐れ https://iototsecnews.jp/2026/04/16/critical-cisco-ise-flaws-let-remote-attackers-execute-malicious-code/ 今回の緊急アドバイザリの内容は、ネットワークの認証管理を担う Cisco ISE の管理画面において、ユーザーが入力したデータに対する検証の不備の修正です。最も深刻な CVE-2026-20147 (CVSS 9.9) は、悪意のリクエストに対するブロックの不備により、攻撃者に対してサーバの基盤となる OS の操作を許すものです。たとえ操作に管理者権限が必要であっても、一度侵入を許せば最高権限である root 奪取やシステム停止にまで発展する恐れがあるため、その影響は壊滅的です。また、CVE-2026-20148 では、本来アクセスできないはずのディレクトリへの不正アクセスが生じます。ご利用のチームは、ご注意ください。 #Cisco #CVE202620147 #CVE202620148 #ISE #ISEPIC #Vulnerability

    Post summary

    The article announces a critical RCE vulnerability (CVE‑2026‑20147) with a CVSS score of 9.9 and confirms an emergency advisory including a patch to mitigate OS-level compromise.

    01000151
    486 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-20148 A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and … https://www.cve.org/CVERecord?id=CVE-2026-20148

    Post summary

    The post announces CVE‑2026‑20148, a path‑traversal vulnerability in Cisco ISE that requires authentication, but offers no PoC, exploit, patch, or active exploitation information.

    00000112
    57.2K followersView on X
CPE platform detail81 entries

81 of 81 entries

PartVendorProductVersionTarget SWTarget HW
Appciscoidentity_services_engine---
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.1.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.2.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.3.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.4.0--
Appciscoidentity_services_engine3.5.0--
Appciscoidentity_services_engine3.5.0--
Appciscoidentity_services_engine3.5.0--
Appciscoidentity_services_engine_passive_identity_connector---
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.1.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.2.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.3.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--
Appciscoidentity_services_engine_passive_identity_connector3.4.0--

Explore more

Back to dashboardcisco CVEsidentity_services_engine vulnerabilities