CVE-2026-20287

Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

No known exploitation. EPSS puts it in the 31st percentile. No fix published yet.

CVSS 3.16.5Medium EPSS percentile31st0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157983

Run the check

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Cisco Identity Services Engine SoftwareAffected: 3.1.0Upgrade to: not statedAffected: 3.1.0 p1Upgrade to: not statedAffected: 3.1.0 p3Upgrade to: not statedAffected: 3.1.0 p2Upgrade to: not stated + 43 more branchesStated by: CVE record
Cisco ISE Passive Identity ConnectorAffected: 3.2.0Upgrade to: not statedAffected: 3.1.0Upgrade to: not statedAffected: 3.3.0Upgrade to: not statedAffected: 3.4.0Upgrade to: not stated + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your IT team or Cisco support whether your Cisco Identity Services Engine deployment is affected by CVE-2026-20287.
Check Cisco’s security advisory for an available fixed version; no patch or fixed version information is currently available.
Restrict and review highly privileged administrator accounts until Cisco provides remediation.
Review administrator activity for unexpected permission or access-policy changes.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20287 are related to improper privilege managment issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-269.

In plain language

Written by AI from the record

This is a flaw in Cisco Identity Services Engine that may let someone who already has powerful access gain more control, and a typical small business using it should act urgently.

Improper privilege management (CWE-269) in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector could enable privilege escalation by an authenticated, highly privileged attacker.

If you're affected

Expanded administrator control
Identity-system compromise
Access policy changes
Sensitive identity data exposure
Operational disruption

What is it

Cisco Identity Services Engine helps control who can access systems and networks. This flaw is like giving a building manager’s master key the ability to unlock additional secured areas that they were not meant to control.

Who is affected

This matters to you if you run Cisco Identity Services Engine, including its Passive Identity Connector. It is a risk when an attacker already has a highly privileged account or has taken control of one.

How urgent is it

A public exploit is available, so treat this as urgent and limit powerful administrator access while you seek Cisco guidance. It is not listed in CISA’s catalog of vulnerabilities known to be exploited in the wild, but the available exploit lowers the barrier for misuse.

What to do — in detail

Identify all Cisco Identity Services Engine deployments, including Passive Identity Connector instances, and confirm their role, version, and administrative access paths.
Check Cisco’s advisory and support channels for affected-release details and fixed versions. No patch, fixed version, or supported workaround is available in the supplied findings.
Until remediation is available, reduce the number of highly privileged accounts, require strong authentication for them, and remove unnecessary administrator access.
Review logs and configuration history for unexpected privilege assignments, administrator-account changes, and access-policy modifications.
No CISA KEV remediation due date applies because CVE-2026-20287 is not listed in KEV. Monitor Cisco advisories for a patch and update plan.

Technical context

CVE-2026-20287 has CVSS 6.5 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. It is an improper privilege management issue under CWE-269; the supplied description characterizes it as part of a Cisco software-hardening release. A public exploit is available, although CISA KEV does not list the CVE and the findings do not confirm exploitation in the wild. EPSS is 0.2% (12th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS31st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 31st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-18Record updated
2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Identity Services Engine SoftwareNetworking Infrastructure
- Cisco ISE Passive Identity ConnectorNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact