CVE-2026-20195— Cisco Identity Services Engine Observable Response Discrepancy Vulnerability

Cisco Identity Services Engine Observable Response Discrepancy Vulnerability

A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affected device. This vulnerability exists because error messages are observed when the affected API endpoint is called. An attacker could exploit this vulnerability by sending a series of crafted requests to the affected endpoint and analyzing the differentiated responses. A successful exploit could allow the attacker to compile a list of valid usernames on an affected system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

响应差异性信息暴露

Cisco ISE 安全漏洞

Cisco ISE是美国思科（Cisco）公司的一个 NAC 解决方案。用于管理零信任架构中的端点、用户和设备对网络资源的访问。 Cisco ISE存在安全漏洞，该漏洞源于调用受影响API端点时观察到错误消息，可能导致未经身份验证的远程攻击者通过发送一系列特制请求并分析差异化响应，枚举有效用户账户。

N/A

N/A