SURIQ
If you run Cisco Identity Services Engine (ISE), the network access control platform that decides which users and devices are allowed onto a network, stop and check your version. On September 16, 2026, Cisco shipped a hardening release that patches six vulnerabilities in ISE and its companion product, the ISE Passive Identity Connector (ISE-PIC). Two of the six are rated the maximum 10.0 on the Common Vulnerability Scoring System (CVSS), and Cisco says one of those two is already being exploited in the wild. Every release from 3.0 through 3.5 is affected.
What Cisco disclosed
Cisco groups the fixes by weakness class and assigns one CVE identifier to each group. The six identifiers, and how Cisco scores them, are:
-
CVE-2026-20192 (CVSS 10.0) improper access control. This is the one Cisco flags as actively exploited.
-
CVE-2026-20130 (CVSS 10.0) improper neutralization of special elements, the class behind injection attacks.
-
CVE-2026-20234 (CVSS 9.9) insufficiently protected credentials.
-
CVE-2026-20237 (CVSS 9.9) improper input validation, covering path traversal.
-
CVE-2026-20194 (CVSS 9.1) incorrect resource transfer between spheres, an information-disclosure class.
-
CVE-2026-20287 (CVSS 6.5) improper privilege management.
The two maximum-severity issues, CVE-2026-20192 and CVE-2026-20130, are reachable over the network with no authentication, per Cisco's own scoring. That combination, remote, unauthenticated, and on a system that governs network access itself, is why this release is not a routine patch cycle. Cisco says it found the bugs through an internal security review rather than an outside report.
Which flaw is already being exploited
Cisco states that CVE-2026-20192, the critical improper access-control flaw, is known to be exploited in the wild. Because ISE is the arbiter of who reaches a network, a working attack against its access controls is not a contained problem: it can undermine the enforcement point the rest of the environment trusts. Access and authentication bugs are not an edge case in our own triage either. They are the fourth most common vulnerability class our desk has logged this quarter, 1,151 of them, behind only cross-site scripting, command injection, and SQL injection.
Cisco has not published indicators of compromise for the exploited variant, so there is no IOC list to import yet. That makes version state your first and clearest signal.
What to do now
Patch to a fixed release for your train. Cisco lists releases 3.0 through 3.5 as affected and provides fixes in the patches below. Release 3.0 has no fix, so a 3.0 deployment must migrate to a fixed train.
3.0 no fix available - migrate to a fixed train 3.1 3.1 Patch 12 3.2 3.2 Patch 11 3.3 3.3 Patch 12 3.4 3.4 Patch 7 3.5 3.5 Patch 4
Two more actions belong in the same maintenance window:
-
Rotate the credentials ISE holds. One of the fixed flaws, CVE-2026-20234, is an insufficiently-protected-credentials issue, so secrets stored on the appliance could be exposed. After patching, rotate the shared secrets and keys ISE keeps: RADIUS shared secrets, TACACS keys, the account ISE uses to join your directory, and administrator passwords.
-
Hunt before you assume you are clean. Because Cisco reports active exploitation and found these internally rather than from a public report, review ISE administrative and operations audit logs for unexpected administrator logins, new or modified accounts, configuration exports, and unusual API access. In ATT&CK terms you are looking for exploitation of a public-facing application (T1190) followed by use of valid accounts (T1078) once access controls are bypassed.
Why an identity system is the wrong place to be behind on patches
Network access control sits in front of everything else, so a flaw that lets an unauthenticated attacker manipulate it can quietly widen into access nobody authorized. The exploited flaw here scores a perfect 10.0 for exactly that reason: it needs no credentials and can affect systems beyond ISE itself. If your patch backlog is prioritized by asset, an identity and access enforcement point belongs at the top of the list, above general-purpose servers, this week.
The full advisory, cisco-sa-hardening-ise-XU5EwX5T, lists every affected component and fixed build. Read it against your own inventory before you close the ticket. Cisco's September 2026 ISE hardening advisory is the authoritative source.