CVE-2026-20190

This issue means someone on the internet may be able to ask the Cisco access-control system for a resource it shouldn’t reveal, and the system may accidentally respond with sensitive details. A common risk with information leaks is that the leaked data—like hashed login credentials—can help an attacker plan the next step. Think of it like a receptionist who shouldn’t hand out confidential folders, but occasionally does when someone asks the right question in the wrong way.

This matters to you if you use or run Cisco Cisco Identity Services Engine Software, Cisco Cisco ISE Passive Identity Connector (Cisco ISE-PIC), or the broader “cisco identity services engine” and “cisco identity services engine passive identity connector” products. Because the flaw can be reached by an unauthenticated remote attacker, it’s relevant even if you don’t have special user accounts exposed to the public internet. If you don’t use these Cisco products, you’re likely not affected.

Set aside time to fix this in the near term (not weeks from now). The estimated probability of exploitation over the next 30 days is low, and there is no confirmation that it’s being exploited in the wild, but a public exploit exists and the issue can expose sensitive information, including hashed credentials. With an information leak, “waiting it out” can increase the chance attackers use the exposed data later.