CVE-2026-20352

A missing authentication vulnerability exists in the Policy Runtime Repository Table (PRRT) service of Cisco ISE and Cisco ISE-PIC. An unauthenticated remote attacker could send a crafted request to retrieve sensitive configuration information from an affected device.

Insufficient authentication on an internal interface exposed through the guest portal of Cisco ISE allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline. A crafted request can manipulate posture status on the affected system.

Insufficient validation of user-supplied input in the certificate import functionality of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files. A crafted request can expose sensitive information.

Insufficient validation of directory traversal character sequences in a user-supplied path in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to access protected files. A crafted request to the provisioning download service can expose sensitive information.

Improper validation of directory traversal character sequences during file upload in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker with administrative privileges to write arbitrary files. A crafted file upload can write to arbitrary locations.

Improper validation of directory traversal character sequences in a user-supplied file path in the file management function of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to delete arbitrary files and directories. A crafted request can delete files on the underlying operating system.

SQL injection vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC due to certain parameters being concatenated directly into SQL clauses without parameterization. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the session database.

XML external entity vulnerability in the offline profiler feed service of Cisco ISE due to parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with administrative credentials can upload a crafted offline feed package to read arbitrary files and issue requests to internal systems.

SQL injection vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of specific parameters that are concatenated into an SQL statement. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the monitoring database.

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint.