A vulnerability in an identity management API endpoint of Cisco ISE could

CVE-2026-20195 is an *observable response discrepancy* (CWE-204) in an identity-management API endpoint of Cisco Identity Services Engine. The endpoint returns subtly different responses — body content, status code, or response time — depending on whether a queried identity exists, lets an unauthenticated remote caller enumerate valid usernames/identities or infer whether an authorization decision applies. The bug is reachable on ISE 3.3 < P11, 3.4 < P6, and 3.5 < P3; fixes shipped April 13–22, 2026 ahead of the May 6 disclosure.

Cisco's MEDIUM (5.3) rating is accurate. The CVSS vector AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N correctly captures the impact: information disclosure only, no write, no DoS, no auth bypass. There is no privilege gain from this bug standing alone — it is a *recon primitive* that an attacker chains with a password-spraying or relay attack. The vendor severity does not need adjusting; the practitioner question is whether the ISE admin/PSN interface that exposes this endpoint is reachable to the attacker at all.

Why this verdict

• Confidentiality-only, no integrity/availability impact — CVSS vector cleanly bounds the blast radius at username/identity disclosure.
• ISE management plane is rarely internet-exposed — Shodan/Censys data shows a low-hundreds population, and Cisco's own deployment guidance restricts admin/ERS APIs to management subnets.
• Role multiplier — ISE is canonically an identity/NAC component, but THIS bug does not grant any identity-trust primitive. It only reveals which usernames exist. The chain to fleet compromise requires a separate spray/MFA-bypass step that this CVE does not provide — the floor stays at MEDIUM rather than escalating.
• No KEV listing, EPSS 0.00275, no public PoC — exploitation pressure is low and there is no indication of mass scanning.
• Patch shipped weeks before disclosure (April 13–22 vs. May 6 advisory) — defenders had a head start and the fix is a standard ISE patch bundle, not a version upgrade.

Why not higher?

Upgrading to HIGH would require either a credential or auth-bypass primitive (this bug has neither), KEV listing, or evidence of mass enumeration campaigns — none are present. The ISE role multiplier does not trigger because the bug yields no identity-trust impact; it only narrows the attacker's spray dictionary.

Why not lower?

Downgrading to LOW would be wrong because ISE underpins NAC and 802.1X for the entire enterprise — any reconnaissance primitive against the identity store has compounding value to a determined attacker, and unauthenticated network-reachable info disclosure on an identity appliance is not backlog hygiene.

1. Restrict ISE admin and ERS API interfaces (TCP/443, TCP/9060) to a hardened management subnet — An ACL on the upstream switch or firewall denying everything outside the mgmt VLAN eliminates the reachable population for this bug. Deploy within the 365-day noisgate remediation window if not already in place — this is also baseline Cisco hardening guidance regardless of this CVE.
2. Enable API rate limiting and lockout on ISE — Caps the rate at which a discrepancy oracle can be probed and produces signal for SOC alerting. Configure under Administration → System → Settings → API Settings.
3. Apply the ISE patch bundle (3.3 P11 / 3.4 P6 / 3.5 P3) — Standard in-place patch via the ISE GUI or application patch install CLI. No data migration, brief services restart on PSN. Schedule within the 365-day noisgate remediation SLA for MEDIUM.
4. Force MFA on every downstream auth surface — Removes the value of harvested usernames by breaking step 3 of the attack path. Layer Duo/Azure Conditional Access on VPN, OWA, and RDP gateways.

Run on an auditor workstation with network reach to the ISE node. Invoke as ./check_cve_2026_20195.sh <ise-host> — e.g. ./check_cve_2026_20195.sh ise-pan01.corp.example.com. No credentials required; this only fingerprints the ISE build via the unauthenticated TLS service banner and the /admin/login.jsp build string.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-20195 (Cisco ISE observable response discrepancy)
# Usage: ./check_cve_2026_20195.sh <ise-host>
# Output: VULNERABLE | PATCHED | UNKNOWN
set -u
HOST="${1:-}"
if [[ -z "$HOST" ]]; then
  echo "UNKNOWN: usage $0 <ise-host>" >&2
  exit 2
fi

# Pull build banner from the admin login page (unauth-readable)
BODY=$(curl -sk --max-time 10 "https://${HOST}/admin/login.jsp" || true)
if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: no response from https://${HOST}/admin/login.jsp"
  exit 2
fi

# Build strings look like: ise-version-3.4.0.608 patch-5
VER=$(echo "$BODY" | grep -oE 'ise-version-[0-9.]+' | head -1 | sed 's/ise-version-//')
PATCH=$(echo "$BODY" | grep -oE 'patch-[0-9]+' | head -1 | sed 's/patch-//')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse ISE version banner — check manually in GUI Administration → System → Maintenance"
  exit 2
fi

PATCH=${PATCH:-0}
MAJ=$(echo "$VER" | cut -d. -f1)
MIN=$(echo "$VER" | cut -d. -f2)

status="UNKNOWN"
case "${MAJ}.${MIN}" in
  3.3) [[ "$PATCH" -ge 11 ]] && status="PATCHED" || status="VULNERABLE" ;;
  3.4) [[ "$PATCH" -ge 6  ]] && status="PATCHED" || status="VULNERABLE" ;;
  3.5) [[ "$PATCH" -ge 3  ]] && status="PATCHED" || status="VULNERABLE" ;;
  *)   status="UNKNOWN" ;;
esac

echo "Host: ${HOST}  Version: ${VER}  Patch: ${PATCH}  => ${status}"
case "$status" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. Cisco Community — ISE CVE-2026-20193 & 20195 KB
2. Cisco PSIRT — ISE Multi-CVE Advisory (cisco-sa-ise-multi-G5WP8vv)
3. Cisco PSIRT — ISE RCE & Path Traversal (cisco-sa-ise-rce-traversal-8bYndVrZ)
4. CVE Details — Cisco ISE vulnerability list
5. MITRE CWE-204 — Observable Response Discrepancy
6. FIRST CVSS v3.1 Specification
7. CISA KEV Catalog
8. FIRST EPSS