CVE-2026-20192: Cisco Identity Services Engine Unauthenticated Authorization Bypass

HERMES

HERMES THREAT SCORE & ZERO-TRUST PERIMETER FRACTURE

Target: Cisco Identity Services Engine (ISE) & ISE Passive Identity Controller (ISE-PIC)

Confidence: 98%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 19 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Both CVSS v3.1 and Hermes Threat Score assign CVE-2026-20192 the highest operational risk tier (CVSS 10.0 / HTS 98). Cisco ISE acts as the central policy decision point for enterprise 802.1X, TACACS+, and RADIUS access. An unauthenticated remote caller can bypass REST authorization filters entirely, creating rogue administrator accounts and modifying trust policies across the enterprise.

HASS

HASS AGENTIC SEVERITY & IDENTITY INFRASTRUCTURE TAKEOVER

Target: Network Access Control Policy Engine & Administrative API Boundary

Confidence: 95%

88 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 18 / 20

Tool Access 19 / 20

Privilege 20 / 15

Persistence 18 / 15

External Impact 19 / 15

Propagation 18 / 15

⚖️ Divergence & Operational Rationale

Gaining unauthorized administrative control of Cisco ISE enables an attacker or rogue automated agent to subvert network segmentation, authorize lateral movement across industrial and corporate VLANs, and export Active Directory identity tokens.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-20192: Cisco Identity Services Engine Unauthenticated Authorization BypassVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCisco Identity Services Engine (ISE)

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Identity Services Engine (ISE) documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Cisco Security Advisory: September 16, 2026

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-284: Improper Access Control / CWE-287: Improper Authentication. Disclosed in the Cisco Security Advisory on September 16, 2026. Affects Cisco ISE 3.1, 3.2, 3.3, and 3.4 prior to the September 2026 maintenance releases.

Executive Summary

On September 16, 2026, Cisco published an urgent advisory addressing CVE-2026-20192, a CVSS 10.0 vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC. The flaw resides in the request dispatching and authorization filter chain of the REST API subsystem. An unauthenticated remote attacker on any network that can reach the management interface (TCP 443 / 9060) can craft HTTP requests that bypass authentication checks, allowing full read and write access to administrative endpoints.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-20192	Cisco Security Advisory cisco-sa-ise-auth-bypass-2026
Vulnerability Class	Authorization Bypass (CWE-284 / CWE-287)	Pre-auth administrative REST API invocation
Affected Component	REST API Request Handler & Filter Interceptor	Ports TCP 443 and 9060 (ERS API / OpenAPI)
Authentication Required	None (PR:N)	Raw HTTP request with spoofed internal headers
User Interaction	None (UI:N)	Immediate programmatic execution
Scope Impact	Changed (S:C)	Propagates to all switches, firewalls, and VPN gateways governed by ISE
Privileges Obtained	Super Administrator (Root ISE Policy Authority)	Unrestricted policy manipulation and credential dumping
Affected Versions	ISE 3.1 (all), 3.2 (prior to Patch 7), 3.3 (prior to Patch 3), 3.4 (prior to Patch 1)	Production Cisco ISE deployments
Remediation Target	Official Cisco Maintenance Patches	Patch 7 (3.2), Patch 3 (3.3), Patch 1 (3.4)

---

2. Vulnerability Anatomy & Root Cause Analysis

The vulnerability exists in the internal Java Servlet filter chain that enforces role-based access control (RBAC) across Cisco ISE’s External RESTful Services (ERS) and OpenAPI endpoints:

graph TD
    Client["Unauthenticated Remote Request"] --> Ingress["HTTP Header Evaluation"]
    Ingress --> Check{"Contains Internal Interceptor Header?"}
    Check -- "Yes" --> Bypass["Skip SecurityFilter & Token Validation"]
    Bypass --> Dispatch["Execute Admin Controller Action (User Creation, Policy Dump)"]
    Check -- "No" --> Enforce["Enforce OAuth / HTTP Basic Auth"]

1. When evaluating inbound REST requests, the security filter checks for the presence of specific internal routing headers used during intra-cluster synchronization between ISE nodes (Primary PAN and Secondary PAN).
2. The servlet filter erroneously trusted client-supplied headers without validating that the connection originated from a mutual TLS (mTLS) authenticated cluster peer.
3. By supplying these headers, an external unauthenticated attacker bypasses the entire token verification routine, gaining access to administrative controllers such as /ers/config/adminuser and /api/v1/policy.

---

3. Attack Vector & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Unauthenticated Attacker
    participant Front as Cisco ISE Web Listener (Port 443/9060)
    participant Filter as REST Security Filter Chain
    participant Controller as Admin Controller Service
    participant DB as Internal PostgreSQL / Policy Store

    Attacker->>Front: POST /ers/config/adminuser with forged cluster header
    Front->>Filter: Forward request to interceptor
    Filter->>Filter: Header matches internal bypass rule (Auth skipped)
    Filter->>Controller: Route to createAdminUser()
    Controller->>DB: Insert rogue SuperAdmin credentials
    DB-->>Attacker: HTTP 201 Created (Full Administrative Access Established)

---

4. Detection Engineering & Threat Hunting

Sigma Rule (Forged Internal Header)

title: Cisco ISE REST Auth Bypass Attempt
id: cisco-ise-cve-2026-20192-bypass
status: production
description: Detects forged internal cluster synchronization headers in external HTTP requests to Cisco ISE.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-2026
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: webserver
  product: cisco_ise
detection:
  selection:
    cs-method: ['POST', 'PUT', 'DELETE', 'GET']
    cs-uri-stem|contains:
      - '/ers/config/'
      - '/api/v1/'
    cs-header|contains:
      - 'X-ISE-Internal-Sync'
      - 'X-Cisco-Cluster-Token'
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.defense_evasion
  - attack.t1078

Suricata Signature (Network Boundary)

alert http any any -> any [443,9060] (
  msg:"HERMES THREAT - Cisco ISE REST API Auth Bypass Attempt (CVE-2026-20192)";
  flow:to_server,established;
  content:"/ers/config/"; http_uri;
  content:"X-ISE-Internal-Sync"; http_header;
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-20192;
  classtype:attempted-admin;
  sid:202620192; rev:1;
)

---

5. Forensic Investigation Playbook

1. Audit Administrator Accounts: Inspect ISE GUI under Administration > System > Admin Access > Administrators for newly created accounts or accounts with altered SuperAdmin privileges within the last 14 days.
2. Review ERS Audit Logs: Export audit logs under /opt/CSCOise/logs/ers.log and search for requests originating from non-management IP ranges:

   grep -E "(adminuser|endpointgroup|internaluser)" /opt/CSCOise/logs/ers.log

3. Verify RADIUS / TACACS+ Policy Integrity: Compare authorization rules against known configuration baselines to detect newly authorized permissive VLAN assignments.

---

6. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Apply Official Cisco Maintenance Release: Apply the appropriate maintenance patch for your release:

   • ISE 3.2: Install Patch 7.
   • ISE 3.3: Install Patch 3.
   • ISE 3.4: Install Patch 1.
   • For ISE 3.1 (End of Software Maintenance), upgrade immediately to 3.2 Patch 7 or 3.3 Patch 3.

2. T0 Mitigation — Restrict Management & ERS API Access: Restrict access to ports TCP 443 and TCP 9060 strictly to dedicated, trusted jump-host IP addresses via firewall access control lists (ACLs).

3. T1 Tactical Hardening (< 7d) — Disable ERS API if Unused: Navigate to Administration > System > Settings > ERS Settings and set ERS to Disable if third-party orchestration integrations are not required.

---

7. Related Intelligence & Attack Paths

Cisco Identity Services Engine Intelligence Track vulnerabilities, patch lifecycle, and network policy security for Cisco ISE.

Cisco ISE Java Deserialization (CVE-2026-20307) Analyze the companion vulnerability allowing privilege escalation to root on ISE hosts.

Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.