The Critical Cisco ISE Flaw Needed Admin Rights. The Other One Needed None.
Cisco disclosed two serious flaws in Identity Services Engine. The critical one could reach root, but it required valid administrator credentials. The lower-scored one needed no login and could expose password hashes that make the first prerequisite easier to obtain.
The pairing is why the June bulletin deserves more than a CVSS sort. CVE-2026-20181 is a command-injection vulnerability rated 9.1. CVE-2026-20190 is an unauthenticated information-disclosure vulnerability rated 7.5. They cross different boundaries, and their operational value changes when defenders consider them together.
Cisco said it was not aware of malicious use or public announcements when it issued the advisory. There are no workarounds. Updates or vendor-provided hot patches are the remediation.
The critical flaw turns an administrator into root
CVE-2026-20181 lets an authenticated remote attacker send a crafted HTTP request that reaches insufficiently validated input. Successful exploitation provides user-level access to the underlying operating system and a route to elevate privileges to root.
The attacker must already have valid administrative credentials. That prerequisite is significant, but it does not make the flaw routine. ISE is a central identity and network-access policy engine. Root access turns a stolen management account into control over the system that helps decide which users and devices are trusted.
The flaw affects Cisco ISE and ISE-PIC regardless of configuration. Cisco credits multiple researchers, including Jonathan Lein of TrendAI Research and Li Jiantao and Tevel Sho of STAR Labs, with reporting it independently.
The high-severity flaw starts without credentials
CVE-2026-20190 is the more accessible entry point. Improper authorisation checks let an unauthenticated remote attacker request a resource and obtain sensitive information, including hashed credentials.
A password hash is not automatically a plaintext password, and the advisory does not say that disclosure alone grants an ISE login. It gives the attacker material for offline cracking, credential analysis and follow-on targeting. The disclosed data can therefore shorten the path to the administrator account required by the command-injection flaw or to another system where the same password was reused.
The vulnerability affects ISE 3.4 and ISE-PIC 3.4, plus ISE 3.5 releases before the fixed patch. Earlier ISE releases are not vulnerable to this specific disclosure issue according to Cisco’s table.
The fixed release depends on the branch
The two vulnerabilities do not share a single universal upgrade target. For ISE and ISE-PIC 3.4, Cisco lists 3.4 Patch 6 as the first fixed release for both issues. For ISE 3.5, 3.5 Patch 3 fixes CVE-2026-20190, while CVE-2026-20181 requires 3.5 Patch 4 or a hot patch requested from Cisco TAC.
Cisco’s July revision added future patch guidance for older supported branches. ISE 3.1 Patch 12 and ISE 3.2 Patch 11 were scheduled for September 2026. ISE 3.3 Patch 11 was listed as the fixed release. Releases earlier than 3.1 need migration to a fixed branch.
That schedule creates an exposure-management problem. An organisation may have a vendor-supported deployment but no generally available patch for its branch on the day the bulletin appears. In that case, the correct response is to contact TAC, restrict administrative reachability, preserve authentication telemetry and plan the branch upgrade, not to mark the finding as accepted because the normal update channel is empty.
Immediate defensive actions
- Identify every ISE and ISE-PIC node, its release, patch level and management exposure.
- Apply the fixed release or request the applicable hot patch from Cisco TAC.
- Restrict ISE management interfaces to dedicated administration networks and approved hosts.
- Review recent access to upgrade resources, unusual HTTP requests and unexpected operating-system commands.
- Rotate administrative credentials when exposure cannot be ruled out, and investigate reuse on other systems.
- Treat disclosed hashes as credential material, not merely as a confidentiality finding.
The bulletin’s lesson is not that two medium-to-critical numbers happened to share a page. One vulnerability can provide the credential material that another vulnerability expects the attacker to bring. Defenders have to model the path between them.
Sources: Cisco advisory (first published 17 June 2026 at 16:00 GMT; updated 6 July 2026 at 19:20 GMT), Cyber Security Agency of Singapore alert AL-2026-081 (published 19 June 2026; no publication time provided), and CERT-FR advisory (published 18 June 2026; no publication time provided).
