CVE-2026-20192Disclosure(cisco / identity_services_engine)

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch cisco identity_services_engine systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

cisco CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T

Weakness type (CWE)

CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

identity_services_engine
identity_services_engine_passive_identity_connector

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 3d ago at 3 mentions (2026-09-17); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

cisco

Products

identity_services_engineidentity_services_engine_passive_identity_connector

3 versions affected across 2 products

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

Disclosure

342.9%

Active Exploitation

228.6%

Patch

228.6%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-16	1	Disclosure1
2026-09-17	3	Active Exploitation1Disclosure1Patch1
2026-09-18	1	Active Exploitation1
2026-09-19	1	Disclosure1
2026-09-22	1	Patch1

Full discourse7 posts

Rıdvan Yağlı@ridvanyagli45d
Active Exploitation
🔴 Cisco, ISE ve Secure Firewall ürünlerinde çok sayıda kritik güvenlik açığını yayınladı! • CVE-2026-76460 — CVSS 10.0: Cisco ISE authentication bypass. Kimlik doğrulaması gerektirmiyor ve aktif olarak sömürülüyor. • CVE-2026-76423 — CVSS 10.0: ISE/ISE-PIC REST API authentication bypass. Unauthenticated admin access mümkün. • CVE-2026-20130 — CVSS 10.0: ISE/ISE-PIC injection sınıfı kritik açık. • CVE-2026-20192 — CVSS 10.0: ISE/ISE-PIC improper access control. • CVE-2026-20242 — CVSS 9.8: Secure FMC'de unauthenticated RCE, root yetkisiyle. • CVE-2026-20307 — CVSS 9.9: ISE'de authenticated RCE. • CVE-2026-20330 — CVSS 9.9: ASA/FTD/FMC'de kritik CWE-707 güvenlik açığı. Cisco, bu açıklar için güvenlik güncellemeleri yayınladı; ilgili advisories'de workaround bulunmadığı belirtiliyor. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T
Post summary
The post discloses multiple critical Cisco vulnerabilities (CVSS 9.8-10.0) affecting ISE and Secure Firewall, explicitly reporting that CVE-2026-76460 is actively exploited in the wild, and confirms that security updates are available with no workarounds.
00022472
2.5K followersView on X
ExploitGrid@exploitgrid45d
Patch
[CVE] CVE-2026-20192 [HIGH PRIORITY] #Cisco Identity Services Engine Hardening Release - Access Control Vulnerabili... 🔗 https://exploitgrid.net/cve/CVE-2026-20192
Post summary
The text announces CVE-2026-20192 as a high-priority Cisco ISE access control vulnerability with a vendor hardening release available, linking to a reference page. It focuses on the available fix rather than exploit code or active exploitation.
1000036
48 followersView on X
ExploitGrid@exploitgrid45d
Disclosure
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-20130 CVE-2026-20192 CVE-2026-70416 CVE-2026-73453 CVE-2026-73456 ..🧵👇
Post summary
The tweet serves as a daily threat digest listing five CVEs (2026-20130, 2026-20192, 2026-70416, 2026-73453, 2026-73456) without providing exploit details, patches, or technical context. It functions as a vulnerability announcement summary.
1000067
48 followersView on X
SecAlerts@SecAlertsCo40d
Patch
🔐 Cisco ISE hit with a CVSS 10 access control flaw. No auth, no interaction, full system compromise. CVE-2026-20192 affects ISE and ISE-PIC. Patch now. #cisco #cybersecurity #ciso #vulnerabilities #msp #mssp https://secalerts.co/vulnerability/CVE-2026-20192?utm_campaign=x https://t.co/XRYyh6dPkV
Post summary
The tweet announces a critical CVSS 10 vulnerability in Cisco ISE, emphasizing immediate patching to mitigate the access control flaw that allows full system compromise without authentication.
00000168
890 followersView on X
zoomeyebot@zoomeyebot43d
Disclosure
🚨 Cisco ISE Critical Flaws Allow Auth Bypass and Root RCE (CVE-2026-20192) Critical Vulnerability Alert! Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) is affected by CVE-2026-20192. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Identity Services Engine" Exposure: 884k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBJZGVudGl0eSBTZXJ2aWNlcyBFbmdpbmUi #Cisco #ISE #CVE-2026-20192 #AuthBypass #RCE #ZeroDay
Post summary
The text serves as a critical vulnerability alert announcing that Cisco ISE and ISE-PIC are affected by CVE-2026-20192, which allows authentication bypass and remote code execution, and provides a ZoomEye search link to identify exposed systems globally.
0000075
23 followersView on X
Centre canadien pour la cybersécurité@centrecyber_ca44d
Active Exploitation
#CyberAlerte | Vulnérabilités Cisco ISE et ISE-PIC Les organisations utilisant Cisco (ISE) et Cisco (ISE-PIC) devraient mettre à jour immédiatement les systèmes touchés. Cisco a confirmé l’exploitation active de la vulnérabilité CVE-2026-76460. https://www.cyber.gc.ca/fr/alertes-avis/al26-021-vulnerabilites-touchant-cisco-identity-services-engine-ise-cisco-ise-passive-identity-connector-ise-pic-cve-2026-20192-cve-2026-76423-cve-2026-76460 https://t.co/vLiwWtuwaD
Post summary
The tweet reports that Cisco has confirmed active exploitation of CVE-2026-76460 affecting Cisco ISE and ISE-PIC, urging organizations to update immediately. No technical details, PoC, or specific patch are provided.
00000123
3.7K followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-20192 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (IS… CVSS 10.0 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20192 #Cisco #CyberSecurity #InfoSec
Post summary
The tweet announces a critical CVE (CVE-2026-20192) affecting Cisco Identity Services Engine with a CVSS 10.0 rating and notes that no patch is available yet.
0000034
90 followersView on X

CPE platform detail42 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

42 of 42 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cisco	identity_services_engine	-	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.3.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.4.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine	3.5.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	-	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.3.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-
App	cisco	identity_services_engine_passive_identity_connector	3.4.0	-	-

Explore more

Back to dashboard cisco CVEs identity_services_engine vulnerabilities

What researchers are saying

CVE-2026-20192

Rıdvan Yağlı[verified]@ridvanyagliActive Exploitation

The post discloses multiple critical Cisco vulnerabilities (CVSS 9.8-10.0) affecting ISE and Secure Firewall, explicitly reporting that CVE-2026-76460 is actively exploited in the wild, and confirms that security updates are available with no workarounds.

zoomeyebot[verified]@zoomeyebotDisclosure

The text serves as a critical vulnerability alert announcing that Cisco ISE and ISE-PIC are affected by CVE-2026-20192, which allows authentication bypass and remote code execution, and provides a ZoomEye search link to identify exposed systems globally.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet announces a critical CVE (CVE-2026-20192) affecting Cisco Identity Services Engine with a CVSS 10.0 rating and notes that no patch is available yet.

ExploitGrid@exploitgridPatch

The text announces CVE-2026-20192 as a high-priority Cisco ISE access control vulnerability with a vendor hardening release available, linking to a reference page. It focuses on the available fix rather than exploit code or active exploitation.

ExploitGrid@exploitgridDisclosure

The tweet serves as a daily threat digest listing five CVEs (2026-20130, 2026-20192, 2026-70416, 2026-73453, 2026-73456) without providing exploit details, patches, or technical context. It functions as a vulnerability announcement summary.

SecAlerts@SecAlertsCoPatch

The tweet announces a critical CVSS 10 vulnerability in Cisco ISE, emphasizing immediate patching to mitigate the access control flaw that allows full system compromise without authentication.

Centre canadien pour la cybersécurité@centrecyber_caActive Exploitation

The tweet reports that Cisco has confirmed active exploitation of CVE-2026-76460 affecting Cisco ISE and ISE-PIC, urging organizations to update immediately. No technical details, PoC, or specific patch are provided.