PT-2026-2048 · Cisco · Cisco Identity Services Engine+1

Bobby Gould · Published 2026-01-07 · Updated 2026-02-21 · CVE-2026-20029

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine versions prior to 3.2 Patch 8 Cisco ISE Passive Identity Connector versions prior to 3.2 Patch 8 Cisco Identity Services Engine versions prior to 3.3 Patch 8 Cisco ISE Passive Identity Connector versions prior to 3.3 Patch 8 Cisco Identity Services Engine versions prior to 3.4 Patch 4 Cisco ISE Passive Identity Connector versions prior to 3.4 Patch 4 Cisco Identity Services Engine version 3.5 and later

Description The issue is an XML External Entity (XXE) processing flaw within the licensing feature of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This flaw allows an authenticated attacker with administrative privileges to upload a malicious file, potentially enabling them to read arbitrary files from the underlying operating system. This could expose sensitive data, including credentials and configurations. A public Proof-of-Concept (PoC) exploit code is available, increasing the risk of exploitation. The vulnerability is due to improper parsing of XML processed by the web-based management interface. There have been no reported real-world exploits at this time. The API endpoints involved are not explicitly mentioned. The vulnerability involves the processing of XML files, and the attacker can upload a malicious file. The vulnerable component is the XML parser used in the licensing feature.

Recommendations Upgrade Cisco Identity Services Engine to version 3.2 Patch 8 or later. Upgrade Cisco ISE Passive Identity Connector to version 3.2 Patch 8 or later. Upgrade Cisco Identity Services Engine to version 3.3 Patch 8 or later. Upgrade Cisco ISE Passive Identity Connector to version 3.3 Patch 8 or later. Upgrade Cisco Identity Services Engine to version 3.4 Patch 4 or later. Upgrade Cisco ISE Passive Identity Connector to version 3.4 Patch 4 or later. If using version 3.5 or later, no action is required.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2026-00377

CVE-2026-20029

ZDI-26-019

Affected Products

Cisco Ise Passive Identity Connector

Cisco Identity Services Engine

References · 40

• https://nvd.nist.gov/vuln/detail/CVE-2026-20029 · Security Note
• https://bdu.fstec.ru/vul/2026-00377 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-jWSbSDKt · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-019 · Security Note
• https://reddit.com/r/SecOpsDaily/comments/1q7a1it/cisco_patches_ise_security_vulnerability_after · Reddit Post
• https://twitter.com/jbhall56/status/2009253783314842003 · Twitter Post
• https://twitter.com/ThreatSynop/status/2009193917535731958 · Twitter Post
• https://twitter.com/threatcluster/status/2009384727510135248 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1q7hpsi/cisco_addresses_critical_flaw_in_identity · Reddit Post
• https://twitter.com/UndercodeNews/status/2009288761104912547 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009748984978366886 · Twitter Post
• https://twitter.com/ThreatSynop/status/2009303525625389443 · Twitter Post
• https://twitter.com/jihad202014/status/2009487328923029970 · Twitter Post
• https://twitter.com/shah_sheikh/status/2009295364390858777 · Twitter Post