Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release - The Hacker News

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release Ravie LakshmananJan 08, 2026Network Security / Vulnerability Cisco has released updates to address a medium-severity security flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) with a public proof-of-concept (PoC) exploit. The vulnerability, tracked as CVE-2026-20029 (CVSS score: 4.9), resides in the licensing feature and could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information. "This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC," Cisco said in a Wednesday advisory. "An attacker could exploit this vulnerability by uploading a malicious file to the application." Successful exploitation of the shortcoming could allow an attacker with valid administrative credentials to read arbitrary files from the underlying operating system, which the company said should be off-limits even to administrators. Bobby Gould of Trend Micro Zero Day Initiative has been credited with discovering and reporting the flaw. It affects the following versions - Cisco ISE or ISE-PIC Release earlier than 3.2 - Migrate to a fixed release Cisco ISE or ISE-PIC Release 3.2 - 3.2 Patch 8 Cisco ISE or ISE-PIC Release 3.3 - 3.3 Patch 8 Cisco ISE or ISE-PIC Release 3.4 - 3.4 Patch 4 Cisco ISE or ISE-PIC Release 3.5 - Not vulnerable Cisco said there are no workarounds to address the flaw, adding it's aware of the availability of a PoC exploit code. There are no indications that it has been exploited in the wild. In tandem, the networking equipment company also shipped fixes for two other medium-severity bugs stemming from the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, impacting availability. Trend Micro researcher Guy Lederfein has acknowledged for reporting the flaws. The details of the issues are as follows - CVE-2026-20026 (CVSS score: 5.8) - Snort 3 DCE/RPC denial-of-service vulnerability CVE-2026-20027 (CVSS score: 5.3) - Snort 3 DCE/RPC information disclosure vulnerability They affect a number of Cisco products - Cisco Secure Firewall Threat Defense (FTD) Software, if Snort 3 was configured Cisco IOS XE Software Cisco Meraki software With vulnerabilities in Cisco products frequently targeted by bad actors, it's crucial that users update to the latest version for adequate protection. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cisco, cybersecurity, denial of service, network security, Snort, Vulnerability Trending News OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues ⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack and Vibe-Coded Malware Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine and More Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1 New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket Load More ▼ Popular Resources Read CYBER360 2026: From Zero Trust Limits to Data-Centric Security Paths Self-Hosted WAF: Block SQLi, XSS, and Bots Before They Reach Your Apps 19,053 Confirmed Breaches in 2025 – Key Trends and Predictions for 2026 Identity Controls Checklist: Find Missing Protections in Apps