Cisco ISE: Patch Available for Directory Traversal CVE-2026-20148

A path traversal vulnerability in Cisco Identity Services Engine allows an authenticated remote attacker to read arbitrary files. A patch is available.

On August 13, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-582 detailing a vulnerability in Cisco Identity Services Engine, tracked as CVE-2026-20148. Cisco PSIRT is not aware of malicious exploitation of the vulnerability at the time of the advisory. The flaw was reported to the vendor on December 18, 2025, by Jonathan Lein of Trend Micro Research. Cisco released software updates on April 28, 2026. The coordinated disclosure reveals the technical details: an authenticated remote attacker can read arbitrary files in the context of the iseadminportal user, with no alternative workarounds available.

Key Takeaways

The vulnerability CVE-2026-20148, classified as CWE-22, resides in the PatchUpdateListener method of Cisco ISE, where the lack of validation of a user-supplied path allows directory traversal.
Authentication is required: the attacker must possess valid administrative credentials for the ISE portal.
The CVSS score is 4.9 (MEDIUM), with impact limited to confidentiality: file read, no modification or code execution.
Cisco has released software updates; the vendor explicitly states that no workarounds exist to mitigate the flaw.

The Mechanism: How Directory Traversal Works in PatchUpdateListener

The flaw lies in the PatchUpdateListener method of the Cisco ISE patch management interface. According to the ZDI advisory, the issue stems from the failure to properly validate a user-supplied path before using it in file operations. In a properly secured web application, the server should sanitize and confine any input that becomes part of a filesystem path. That control is missing or insufficient here.

An authenticated attacker can therefore manipulate the path parameter to traverse the underlying operating system's directory hierarchy and access files that should not be reachable from the web interface. The operation executes with the privileges of the iseadminportal user, a dedicated OS account for the administrative portal.

The official CVE record on cve.org classifies the weakness as CWE-22: "Improper Limitation of a Pathname to a Restricted Directory." The CVSS:3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms the attack is remote (AV:N), low complexity (AC:L), but requires high privileges (PR:H). Impact is limited to confidentiality (C:H), with no effect on integrity (I:N) or availability (A:N).

"An attacker can leverage this vulnerability to disclose information in the context of the iseadminportal user." — Advisory ZDI-26-582

Authentication Required: The Vector and Credentials

The administrative authentication barrier reduces the attack surface but does not eliminate it. In enterprise environments, Cisco ISE manages network access control (NAC), Active Directory integration, device profiling, and security policies. Administrators of this platform hold a privileged position.

Cisco PSIRT states it is not aware of public or malicious use at the time of publication. The exposure window remains open for organizations that have not yet applied the updates released on April 28, 2026.

The absence of workarounds demands a severe risk assessment: organizations unable to update immediately have no vendor-certified technical compensations.

Immediate Actions

Priority actions derive directly from official sources:

Verify the installed version of Cisco ISE/ISE-PIC. The Cisco advisory indicates "Earlier than 3.1" as the version to migrate to fixed releases; specific intermediate versions are not documented in available sources.
Schedule the update as soon as possible: Cisco's statement on the non-existence of workarounds makes the patch the only available mitigation.

Coordinated Disclosure: Eight Months from Discovery to Publication

The timeline documented by the ZDI advisory shows a structured disclosure cycle: reported December 18, 2025; coordinated publication August 13, 2026. Cisco responded with a preliminary advisory on April 15, 2026, and the patched update on April 28. This timeline reflects the complexity of testing and deploying fixes in an on-premise platform like ISE.

The delay between the patch and full public disclosure has a dual effect. Organizations that updated before August 13, 2026, are not exposed to the now-public technical details. Those that delayed patching face an informed risk: the ZDI advisory publication provides the technical description of the vulnerable method.

What Is Not Known

The three converging primary sources — ZDI advisory, CVE record, Cisco advisory — do not document several elements relevant to risk assessment:

The specific versions of Cisco ISE/ISE-PIC vulnerable beyond the generic indication "Earlier than 3.1."
The existence of a public proof-of-concept or in-the-wild exploits.
The exact extent of readable files or sensitive information actually exposed.
Whether the vulnerability was exploited in real attacks before the patch.
The exact technical details of the crafted HTTP request (parameters, specific endpoint).

These gaps stem from the nature of the available sources, not from a lack of analysis. Organizations must assess risk based on verified facts: authentication required, confidentiality impact, no workarounds, patch available since April 28, 2026.

Researcher Jonathan Lein of Trend Micro Research is credited with the discovery. Trend Micro Research is the vulnerability research unit of Trend Micro, the company that operates the Zero Day Initiative.

Sources: Advisory ZDI-26-582 (Zero Day Initiative), CVE Record CVE-2026-20148 (cve.org), Cisco Security Advisory cisco-sa-ise-rce-traversal-8bYndVrZ.

Information verified against cited sources and current as of publication.

Sources

Sources and references