cbcvebase.
CVE-2026-20195
published 2026-05-06

CVE-2026-20195: A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an…

PriorityP335medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.27%
19.3th percentile
A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affected device. This vulnerability exists because error messages are observed when the affected API endpoint is called. An attacker could exploit this vulnerability by sending a series of crafted requests to the affected endpoint and analyzing the differentiated responses. A successful exploit could allow the attacker to compile a list of valid usernames on an affected system.

Affected

42 ranges· showing 25
VendorProductVersion rangeFixed in
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscocisco_identity_services_engine_software——
ciscoidentity_services_engine<= 3.2.0—
ciscoidentity_services_engine——
ciscoidentity_services_engine——
ciscoidentity_services_engine——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.