CVE-2026-20195: 
Cisco ISE vulnerability analysis and mitigation

CVE-2026-20195 is an Observable Response Discrepancy vulnerability in the identity management API endpoint of Cisco Identity Services Engine (ISE) that allows an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability was disclosed on May 6, 2026, and affects Cisco ISE releases 3.3, 3.4, and 3.5 (with specific patch levels), while release 3.6 and Cisco ISE Passive Identity Connector (ISE-PIC) are not affected. It carries a CVSS v3.1 base score of 5.3 (Medium) (Cisco Advisory, GitHub Advisory).

The root cause is classified as CWE-204 (Observable Response Discrepancy): the affected identity management API endpoint returns differentiated error messages depending on whether a submitted username is valid or invalid, inadvertently leaking internal state to unauthenticated callers. An attacker exploits this by sending a series of crafted HTTP requests to the endpoint and analyzing the varying responses to distinguish valid from invalid usernames. No authentication or special privileges are required, and the attack can be conducted entirely over the network with low complexity. No public proof-of-concept code has been identified at this time (Cisco Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to compile a list of valid usernames on the affected Cisco ISE device, resulting in a limited confidentiality impact. While there is no direct integrity or availability impact, the enumerated usernames can facilitate follow-on attacks such as credential stuffing, brute-force authentication attempts, or targeted phishing against ISE administrators and network access control users. Given ISE's role as a central network access control and policy enforcement platform, exposure of valid account names could meaningfully lower the barrier for further compromise of network infrastructure (Cisco Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Cisco ISE instances running affected versions (3.3 prior to Patch 11, 3.4 prior to Patch 6, or 3.5 prior to Patch 3) using network scanning tools such as Nmap or Shodan.
2. Locate the identity management API endpoint: Identify the specific ISE identity management API endpoint (e.g., REST API endpoints used for user account management) that returns differentiated error responses.
3. Craft enumeration requests: Send a series of HTTP requests to the identified endpoint, varying the username field with candidate usernames (e.g., from a wordlist or common naming conventions).
4. Analyze differential responses: Compare the error messages or response codes returned for each request — valid usernames will produce a distinct response compared to invalid ones, allowing the attacker to distinguish existing accounts.
5. Compile username list: Aggregate all usernames that produced the "valid user" response pattern to build a list of confirmed accounts for use in subsequent attacks such as password spraying or targeted phishing (Cisco Advisory).

• Network: High volume of unauthenticated HTTP requests to Cisco ISE identity management API endpoints from a single or small set of source IP addresses; sequential or pattern-based username submissions in API request bodies.
• Logs: ISE API access logs showing repeated requests to identity management endpoints with varying usernames and no successful authentication; unusual spikes in API error responses (e.g., "user not found" vs. other error types) from external or unexpected source IPs.
• Behavioral: Automated, rapid-fire request patterns to the identity management API endpoint inconsistent with normal administrative usage; requests originating from IP addresses not associated with known administrators or management networks.

Cisco has released fixed software versions to address this vulnerability: ISE 3.3 Patch 11, ISE 3.4 Patch 6, and ISE 3.5 Patch 3. ISE release 3.6 is not vulnerable, and ISE 3.2 and earlier should migrate to a fixed release. Cisco has confirmed there are no workarounds available for this vulnerability. As interim risk reduction measures, administrators should restrict network access to the ISE identity management API endpoints to trusted management networks only, and consider implementing rate limiting on the affected endpoint to slow enumeration attempts (Cisco Advisory).

Cisco credited an external researcher for reporting the vulnerability and confirmed through its PSIRT that no public exploitation or malicious use has been observed (Cisco Advisory). The vulnerability received routine coverage in threat intelligence aggregators and security news feeds shortly after disclosure, but no significant independent researcher commentary or notable social media discussion has been identified beyond standard CVE tracking.