Cisco ISE Authenticated Directory Traversal (CVE-2026-20146)…

A directory traversal flaw in Cisco Identity Services Engine lets authenticated attackers read sensitive files. The vulnerability, rated CVSS 5.5, was disclosed on July 15, 2026 after 189 days of coordinated disclosure with Trend Micro ZDI.

Cisco has fixed a directory traversal vulnerability in Identity Services Engine, publicly disclosed on July 15, 2026 after nearly six months of coordinated disclosure with Trend Micro Zero Day Initiative. The flaw, tracked as CVE-2026-20146 and published in advisory ZDI-26-421, allows a remote authenticated attacker to read files outside intended directories by exploiting a defect in the validFileNameOrPath method. The CVSS score is 5.5, medium severity, but the context of Cisco ISE — a central platform for network access control and identity management in large infrastructures — makes the attack surface broader than the number suggests.

Key Takeaways

CVE-2026-20146 is a directory traversal vulnerability in the validFileNameOrPath method of Cisco Identity Services Engine, with CVSS 5.5 per the ZDI advisory.
Exploitation requires authentication: the attacker operates in the context of the iseadminportal service user.
Cisco has released a patch; public disclosure occurred on July 15, 2026, 189 days after the initial report on January 8, 2026.
The dossier does not specify affected versions, exposed endpoints, or whether the vulnerability has been actively exploited.

How the Flaw in validFileNameOrPath Works

The flaw resides in the implementation of Cisco ISE's validFileNameOrPath method. According to advisory ZDI-26-421, the method fails to properly validate a user-supplied path before using it in file operations. The lack of sanitization allows injection of directory traversal sequences — typically ../ constructs or equivalents — that shift the read point outside the intended directory. The authenticated attacker thus gains access to operating system files within the scope of the iseadminportal user.

"The specific flaw exists within the implementation of the validFileNameOrPath method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations." — Advisory ZDI-26-421

The execution context matters: iseadminportal is a service account tied to the ISE administrative portal, not a generic user. The dossier does not clarify this account's privilege level in the underlying OS, nor which directories are actually reachable. The documented impact is limited to information disclosure; the advisory does not indicate possibility of write access, code execution, or local privilege escalation.

Why CVSS 5.5 on an Identity System Is Not Trivial

The CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N vector confirms the authenticated nature: the 5.5 score stems largely from the high-privilege prerequisite (PR:H). In a NAC/AAA architecture, however, accounts with administrative access to ISE are numerous: network operators, security teams, integrators, service accounts for automation. A compromised account — via phishing, credential stuffing, or insider threat — satisfies the authentication requirement without further barrier.

Cisco ISE manages access policies, device profiling, Active Directory integration, and certificate distribution. Unauthorized reading of configuration files, logs, or policy data could facilitate internal reconnaissance and lateral movement in environments where ISE is the hub of network segmentation. The dossier does not specify which files are actually accessible, but ISE's structure includes certificate repositories, internal databases, and policy files that represent high-value targets for an attacker already inside the perimeter.

Timeline and Disclosure Process

The vulnerability was reported to Cisco on January 8, 2026. Coordinated public disclosure occurred on July 15, 2026, an interval of 189 days. During this period Cisco developed and released a patch, though the ZDI advisory does not specify the Cisco update identifier or a direct link to vendor documentation. The source states generically that "Cisco has issued an update to correct this vulnerability."

Publication in ZDI's "published" list — with reference ZDI-CAN-28724 — confirms data consistency: CVE-2026-20146, CVSS 5.5, date July 15, 2026. The CVE record exists and is validated by cve.org, but its textual content was not extracted in the dossier: it serves as identificatory confirmation, not as a source of additional technical detail.

Why This Matters

The dossier does not document specific remediation measures or a verification procedure to determine if an installation is affected. No evidence of active exploitation in the wild emerges, but the absence of this information does not equal denial. The exact attack vector — API endpoint, HTTP method, request parameters — is not detailed in the public advisory, making precise assessment of the exposed surface impossible without access to the patch or Cisco documentation.

The source does not specify the nature of readable data nor whether iseadminportal can access credentials, keys, or certificates. This limit is significant: in an identity management system, compromise of cryptographic materials or authentication configuration would represent a multiplier impact compared to mere reading of generic files. The editorial assessment is that actual severity depends on deployment posture: organizations with ISE in a critical position and shared or weakly protected administrative accounts face a substantially higher risk than the isolated CVSS score suggests.

The advisory does not list specific affected versions. Administrators must refer to Cisco update documentation to determine their installation status. The brief provides no operational guidance on how to verify the flaw's presence or how to prioritize patch application in heterogeneous environments.

Information is based on the cited source and current as of publication.

Sources

Sources and references