Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-20194

Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities

En bref

Sévérité
CRITICAL 9.1
EPSS
EPSS 0.48 % · centile 41 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Awaiting Analysis

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20194 are related to incorrect resource transfer between spheres that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-669.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hcisco
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HNVD · psirt@cisco.com (Secondary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Cisco · Cisco Identity Services Engine Softwareaffected 3.1.0 ; affected 3.1.0 p1 ; affected 3.1.0 p3 ; affected 3.1.0 p2 ; affected 3.2.0 ; affected 3.1.0 p4
Cisco · Cisco ISE Passive Identity Connectoraffected 3.2.0 ; affected 3.1.0 ; affected 3.3.0 ; affected 3.4.0 ; affected 3.5.0

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD