H-ISAC TLP White Vulnerability Bulletin: Cisco Patches Identity Services Engine (ISE) Security Flaw (CVE-2026-20029)

On January 7, 2026, Cisco released security updates to address a medium-severity vulnerability, tracked as CVE-2026-20029, affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) network access control solutions.

This flaw enables an authenticated, remote attacker with administrative privileges to access sensitive files from the underlying operating system that should be restricted. Although there is no evidence of active exploitation, a proof-of-concept (PoC) exploit is publicly available, which significantly increases the risk of potential abuse.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their level of risk to this vulnerability. 

View the detailed bulletin below.