Cisco patched a bug in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products that allows remote attackers with admin-level privileges to access sensitive information - and warned that a public, proof-of-concept exploit for the flaw exists online.

ISE is Cisco's network access control and security policy platform, and companies use it to centrally manage and enforce security policies across users and devices.

The bug, tracked as CVE-2026-20029, received a medium-severity 4.9 CVSS rating and it affects ISE and ISE-PIC, regardless of device configuration. It's due to improper parsing of XML processed by ISE and ISE-PIC's web-based management interface.

"An attacker could exploit this vulnerability by uploading a malicious file to the application," according to the Wednesday security advisory. "A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators."

Cisco credited Trend Micro Zero Day Initiative's bug hunter Bobby Gould with spotting and reporting this vulnerability.

"This vulnerability does require authentication, so that's the first barrier to exploitation," ZDI's Head of Threat Awareness Dustin Childs told The Register, adding that ZDI doesn't expect to see widespread abuse of this flaw given its high-privilege requirements.

But, assuming that an attacker stole or otherwise obtained admin credentials, they "could leak the contents of files on an affected system," Childs added.

The good news is that, as of now, Cisco and ZDI say they're not aware of any in-the-wild abuse of this CVE.

But considering the existence of a POC, which provides a blueprint on how to exploit the bug, we're guessing that CVE-2026-20029's exploitation status will soon change - so patch now.

• Attackers turned Citrix, Cisco 0-day exploits into custom-malware hellscape
• No login? No problem: Cisco ISE flaw gave root access before fix arrived, say researchers
• Watch out, another max-severity, make-me-root Cisco bug on the loose
• One criminal, 50 hacked organizations, and all because MFA wasn't turned on

It's unclear who published the POC, and Childs told us it wasn't ZDI. "We have not published PoC for this bug and have no plans to do so," he said. "We're not aware where the public PoC was published."

Companies should prioritize implementing this fix as networking devices are long-time favorites among government-backed attackers - and especially those from China - which means companies shouldn't leave these holes open for long.

In November, Amazon warned that an "advanced" attacker had exploited a max-severity ISE bug (CVE-2025-20337) as a zero-day to deploy custom malware. 

In July, researchers warned that miscreants had been exploiting another 10 out of 10 CVSS-rated ISE flaw (CVE-2025-20281), prompting Cisco to acknowledge in-the-wild activity and urge customers to patch.

The networking giant had originally disclosed CVE-2025-20281 in a June security advisory covering multiple max-severity flaws in the same ISE products, and later updated the bulletin as exploitation emerged. ®