Cisco has patched a high-severity ISE vulnerability that allows authenticated administrators to access sensitive system files, posing risk to organizations using ISE for network access control.
The vulnerability impacts both Cisco ISE and the Cisco Identity Services Engine Passive Identity Connector (ISE-PIC).
Successful exploitation “… could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators,” said Cisco in its advisory.
How the Cisco ISE Vulnerability Works
CVE-2026-20029 originates from improper XML parsing within Cisco ISE’s web-based management interface, where user-supplied XML input is not sufficiently validated before being processed.
An authenticated administrator can exploit this weakness by uploading a specially crafted XML file that instructs the system to read arbitrary files from the underlying operating system.
The issue closely resembles an XML external entity (XXE)–style flaw, in which inadequate input controls allow access to system resources outside the intended scope of the application.
Although exploitation requires valid administrative credentials, the security impact is potentially substantial.
The vulnerability effectively breaks internal trust boundaries within ISE, allowing attackers to retrieve files that are explicitly restricted even from admin users.
Exposed data may include configuration files, service credentials, authentication secrets, or other sensitive artifacts that can enable lateral movement, privilege escalation, or persistence within the environment.
The availability of public proof-of-concept (PoC) code further increases risk, as it lowers the technical barrier to exploitation and accelerates attacker adoption.
While Cisco has not observed exploitation in the wild at the time of writing, organizations should assume the vulnerability may be weaponized.
Protecting Identity Infrastructure From Abuse
Because the vulnerability targets trusted management interfaces, organizations should assume that compromised credentials could be used to exploit it.
The following measures focus on reducing exposure, limiting the impact of abuse, and improving visibility into administrative activity.
- Upgrade immediately to Cisco-validated fixed releases for ISE and ISE-PIC and ensure all nodes in distributed deployments are patched consistently.
- Restrict access to the ISE web management interface to dedicated management networks or jump hosts and block unnecessary administrative paths.
- Enforce least-privilege administrative roles, regularly review permissions, and limit file upload and advanced configuration capabilities.
- Strengthen credential security by requiring multi-factor authentication, rotating privileged credentials, and using PAM where possible.
- Monitor and audit administrative activity closely, including XML uploads, file access attempts, and actions occurring outside normal maintenance windows.
- Validate system integrity after patching by reviewing logs, configurations, and backups to confirm no sensitive data was accessed or exfiltrated.
These steps reinforce the need to treat identity infrastructure as a high-value target, not just a supporting security service.
Vulnerabilities in platforms like ISE can undermine zero-trust strategies if administrative access and visibility are not tightly controlled.
Identity Platforms Are High-Value Targets
This vulnerability reflects a broader shift in attacker behavior, with identity and access management platforms increasingly targeted as high-impact points of control within enterprise environments.
Compromising these systems can give attackers visibility, persistence, and leverage far beyond a single application or device.
As organizations continue to centralize authentication and authorization through platforms like ISE, weaknesses in identity infrastructure carry outsized risk.
Building resilience requires assuming identity systems will be targeted and designing zero-trust aligned defenses, continuous monitoring, and response plans that limit impact even when trusted components are compromised.