Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

Cisco has issued updates to fix a medium-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after a public PoC exploit was released. The flaw, CVE-2026-20029 (CVSS 4.9), sits in the licensing feature and could allow an authenticated, remote attacker with administrative privileges to read arbitrary files from the underlying operating system by exploiting improper XML parsing via the web-based management interface, according to Cisco.

The PoC exploit has been publicly available, and the company notes there are no workarounds, with no indications of active exploitation in the wild. Bobby Gould of Trend Micro Zero Day Initiative is credited with discovering and reporting the flaw, which affects several releases including pre-3.2 and specific 3.2–3.4 patches, while 3.5 is not vulnerable.

In tandem, Cisco shipped fixes for two Snort 3 DCE/RPC flaws (CVE-2026-20026 and CVE-2026-20027) that could allow an unauthenticated, remote attacker to cause a denial of service or disclose information, with Cisco advising updated versions for affected products.