{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20148", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.385Z", "datePublished": "2026-04-15T16:03:31.727Z", "dateUpdated": "2026-04-15T16:56:35.471Z"}, "containers": {"cna": {"title": "Cisco Identity Services Engine Path Traversal Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ", "name": "cisco-sa-ise-rce-traversal-8bYndVrZ"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-ise-rce-traversal-8bYndVrZ", "discovery": "EXTERNAL", "defects": ["CSCws52717"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "cwe", "cweId": "CWE-22"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p2", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.3.0", "status": "affected"}, {"version": "3.2.0 p3", "status": "affected"}, {"version": "3.2.0 p4", "status": "affected"}, {"version": "3.1.0 p8", "status": "affected"}, {"version": "3.2.0 p5", "status": "affected"}, {"version": "3.2.0 p6", "status": "affected"}, {"version": "3.1.0 p9", "status": "affected"}, {"version": "3.3 Patch 2", "status": "affected"}, {"version": "3.3 Patch 1", "status": "affected"}, {"version": "3.3 Patch 3", "status": "affected"}, {"version": "3.4.0", "status": "affected"}, {"version": "3.2.0 p7", "status": "affected"}, {"version": "3.3 Patch 4", "status": "affected"}, {"version": "3.4 Patch 1", "status": "affected"}, {"version": "3.1.0 p10", "status": "affected"}, {"version": "3.3 Patch 5", "status": "affected"}, {"version": "3.3 Patch 6", "status": "affected"}, {"version": "3.4 Patch 2", "status": "affected"}, {"version": "3.3 Patch 7", "status": "affected"}, {"version": "3.4 Patch 3", "status": "affected"}, {"version": "3.5.0", "status": "affected"}, {"version": "3.4 Patch 4", "status": "affected"}, {"version": "3.3 Patch 8", "status": "affected"}, {"version": "3.2 Patch 8", "status": "affected"}, {"version": "3.5 Patch 1", "status": "affected"}, {"version": "3.3 Patch 9", "status": "affected"}, {"version": "3.2 Patch 9", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco ISE Passive Identity Connector", "versions": [{"version": "3.2.0", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.3.0", "status": "affected"}, {"version": "3.4.0", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:31.727Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:50:58.114801Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T16:56:35.471Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:50:58.114801Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T16:56:30.594Z"}}], "cna": {"title": "Cisco Identity Services Engine Path Traversal Vulnerability", "source": {"defects": ["CSCws52717"], "advisory": "cisco-sa-ise-rce-traversal-8bYndVrZ", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.1.0 p1"}, {"status": "affected", "version": "3.1.0 p3"}, {"status": "affected", "version": "3.1.0 p2"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.1.0 p4"}, {"status": "affected", "version": "3.1.0 p5"}, {"status": "affected", "version": "3.2.0 p1"}, {"status": "affected", "version": "3.1.0 p6"}, {"status": "affected", "version": "3.2.0 p2"}, {"status": "affected", "version": "3.1.0 p7"}, {"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.2.0 p3"}, {"status": "affected", "version": "3.2.0 p4"}, {"status": "affected", "version": "3.1.0 p8"}, {"status": "affected", "version": "3.2.0 p5"}, {"status": "affected", "version": "3.2.0 p6"}, {"status": "affected", "version": "3.1.0 p9"}, {"status": "affected", "version": "3.3 Patch 2"}, {"status": "affected", "version": "3.3 Patch 1"}, {"status": "affected", "version": "3.3 Patch 3"}, {"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.2.0 p7"}, {"status": "affected", "version": "3.3 Patch 4"}, {"status": "affected", "version": "3.4 Patch 1"}, {"status": "affected", "version": "3.1.0 p10"}, {"status": "affected", "version": "3.3 Patch 5"}, {"status": "affected", "version": "3.3 Patch 6"}, {"status": "affected", "version": "3.4 Patch 2"}, {"status": "affected", "version": "3.3 Patch 7"}, {"status": "affected", "version": "3.4 Patch 3"}, {"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.4 Patch 4"}, {"status": "affected", "version": "3.3 Patch 8"}, {"status": "affected", "version": "3.2 Patch 8"}, {"status": "affected", "version": "3.5 Patch 1"}, {"status": "affected", "version": "3.3 Patch 9"}, {"status": "affected", "version": "3.2 Patch 9"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco ISE Passive Identity Connector", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.4.0"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ", "name": "cisco-sa-ise-rce-traversal-8bYndVrZ"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:31.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20148", "state": "PUBLISHED", "dateUpdated": "2026-04-15T16:56:35.471Z", "dateReserved": "2025-10-08T11:59:15.385Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-04-15T16:03:31.727Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system."}], "id": "CVE-2026-20148", "lastModified": "2026-04-15T17:17:02.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Primary"}]}, "published": "2026-04-15T17:17:02.637", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "psirt@cisco.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:20:24.139612+00:00", "value": {"mitigation_remediation": ["Upgrade the Cisco ISE or ISE\u2011PIC system to the latest version that resolves the path traversal issue.", "Restrict administrative privileges to a minimal set of trusted users and enforce strong authentication to reduce the chance of credential compromise.", "Monitor web server and application logs for repeated path traversal attempts and deploy firewall or reverse proxy rules to block suspicious requests."], "summary": {"action": "Apply Patch", "impact": "Potential read of arbitrary files via path traversal by authenticated administrators"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Cisco ISE and Cisco ISE-PIC. No specific version information is listed, indicating that all released versions remain vulnerable until a patch is applied.", "description_and_impact": "A flaw in Cisco Identity Services Engine and its Passive Identity Connector component permits an authenticated user to conduct path traversal on the underlying operating system. The flaw arises from inadequate validation of user\u2011supplied HTTP parameters, enabling the attacker to request arbitrary files after authentication. The consequence is the potential disclosure of sensitive configuration or credential files, effectively compromising confidentiality for accounts with administrative privileges. While authentication is required, the lack of further checks means any compromised admin can read protected files.", "risk_and_exploitability": "The CVSS score of 4.9 reflects a moderate impact with limited attack surface. No EPSS score is available and the flaw is not listed in the KEV catalog. Exploitation requires valid administrative credentials, so the risk is largely confined to environments where such access is possible. Because no public exploitation has been reported, the threat is controlled by access management and timely patching."}}}}, "created": "2026-04-15T19:30:12.381983+00:00", "updated": "2026-04-15T19:30:12.381994+00:00", "vendors": []}