Public PoC prompts Cisco patch for ISE, ISE-PIC vulnerability

Cisco has patched a medium-severity vulnerability in ISE and ISE-PIC after a public PoC exploit was disclosed. The flaw, tracked as CVE-2026-20029 (CVSS 4.9), resides in the licensing feature due to improper XML parsing in the web management interface, allowing an authenticated remote attacker with administrative privileges to read arbitrary files from the underlying operating system.

According to the article, the attacker would need valid administrative credentials to exploit the flaw, and the vulnerability affects all Cisco ISE and ISE-PIC deployments with no workarounds currently available. The researcher Bobby Gould of Trend Micro Zero Day Initiative reported the flaw, and Cisco PSIRT confirms a public PoC exploit exists but cites no evidence of active malicious exploitation at present. The advisory includes the list of affected releases and the fixed versions, with guidance to migrate to the first fixed release for each affected branch.