CVE WatchSep 16, 2026

CVE-2026-20194

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass

CVSS

9.1

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 16, 2026 · Last modified: Sep 16, 2026 · CWE-669

EPSS · 30d

Not enough EPSS history yet.

Technical description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20194 are related to incorrect resource transfer between spheres that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-669.

Official references

sec.cloudapps.cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-258323.7 LOW

12.4%

——4In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.3d CVE-2023-372533.1 LOW

9.6%

——3An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.16h CVE-2023-372523.1 LOW

9.6%

——3An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.16h CVE-2023-328037.5 HIG

8.1%

——2The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.3d CVE-2026-389242.9 LOW

1.9%

——1In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."3d CVE-2025-454803.0 LOW

4.9%

——1Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.3d