Cisco Identity Services Engine Vulnerable to Information Disclosure via Directory Traversal
A directory traversal vulnerability in Cisco Identity Services Engine (ISE) allows authenticated attackers to disclose sensitive information.
The Zero Day Initiative (ZDI) has disclosed a directory traversal vulnerability affecting Cisco Identity Services Engine (ISE), identified as ZDI-26-421 and assigned CVE-2026-20146. This flaw allows authenticated remote attackers to access and disclose sensitive information on vulnerable installations.
The vulnerability resides within the validFileNameOrPath method of the Cisco ISE software. The root cause is the improper validation of user-supplied path data before it is used in file operations. This oversight enables an attacker, who has already gained authenticated access to the system, to manipulate the path to traverse directories and access files outside of the intended scope.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information residing on the affected ISE appliance. The specific context of the disclosure is under the privileges of the iseadminportal user, which could potentially expose administrative or system-level data. The CVSS score for this vulnerability has been set at 5.5, indicating a moderate severity.
Cisco has acknowledged the vulnerability and released security updates to address it. The company published a security advisory detailing the affected versions and the necessary patches. Users are strongly advised to consult the official Cisco Security Advisory (cisco-sa-ise-traversal-xNt7wb2Y) for detailed information on remediation and affected product versions.
The disclosure timeline indicates that the vulnerability was initially reported to Cisco on January 8, 2026. Following a coordinated disclosure process, ZDI and Cisco publicly released the advisory on July 15, 2026, with an update to the advisory also occurring on the same date. The research leading to the discovery of this flaw is credited to Jonathan Lein of Trend Research.
While this vulnerability requires authentication, it highlights a common class of flaws where insufficient input validation allows attackers to bypass intended access controls. Directory traversal vulnerabilities can have significant impacts, ranging from information disclosure to more severe consequences like arbitrary file deletion or even remote code execution in certain contexts.
Organizations utilizing Cisco ISE should prioritize applying the available security updates to mitigate the risk posed by CVE-2026-20146. Regular security patching and robust access control policies are crucial for defending against such information disclosure threats. The timely patching of such vulnerabilities is essential to maintain the integrity and confidentiality of network access control systems.