9.1

CVE-2026-20194

Medienbericht

Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20194 are related to incorrect resource transfer between spheres that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-669.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco Identity Services Engine Software
Default Statusunknown
Version 3.1.0
Status affected
Version 3.1.0 p1
Status affected
Version 3.1.0 p3
Status affected
Version 3.1.0 p2
Status affected
Version 3.2.0
Status affected
Version 3.1.0 p4
Status affected
Version 3.1.0 p5
Status affected
Version 3.2.0 p1
Status affected
Version 3.1.0 p6
Status affected
Version 3.2.0 p2
Status affected
Version 3.1.0 p7
Status affected
Version 3.3.0
Status affected
Version 3.2.0 p3
Status affected
Version 3.2.0 p4
Status affected
Version 3.1.0 p8
Status affected
Version 3.2.0 p5
Status affected
Version 3.2.0 p6
Status affected
Version 3.1.0 p9
Status affected
Version 3.3 Patch 2
Status affected
Version 3.3 Patch 1
Status affected
Version 3.3 Patch 3
Status affected
Version 3.4.0
Status affected
Version 3.2.0 p7
Status affected
Version 3.3 Patch 4
Status affected
Version 3.4 Patch 1
Status affected
Version 3.1.0 p10
Status affected
Version 3.3 Patch 5
Status affected
Version 3.3 Patch 6
Status affected
Version 3.4 Patch 2
Status affected
Version 3.3 Patch 7
Status affected
Version 3.4 Patch 3
Status affected
Version 3.5.0
Status affected
Version 3.4 Patch 4
Status affected
Version 3.3 Patch 8
Status affected
Version 3.2 Patch 8
Status affected
Version 3.5 Patch 1
Status affected
Version 3.3 Patch 9
Status affected
Version 3.2 Patch 9
Status affected
Version 3.4 Patch 5
Status affected
Version 3.5 Patch 3
Status affected
Version 3.5 Patch 2
Status affected
Version 3.3 Patch 10
Status affected
Version 3.3 Patch 11
Status affected
Version 3.4 Patch 6
Status affected
Version 3.2 Patch 10
Status affected
Version 3.1.0 p72
Status affected
Version 3.1.0 p11
Status affected
HerstellerCisco
≫
Produkt Cisco ISE Passive Identity Connector
Default Statusunknown
Version 3.2.0
Status affected
Version 3.1.0
Status affected
Version 3.3.0
Status affected
Version 3.4.0
Status affected
Version 3.5.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.381
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-669 Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
17.09.2026 15:48
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T