# CVE-2026-20234: Cisco Identity Services Engine insufficiently protected credentials

Source: https://junglewise.ai/threats/cve-2026-20234-cisco-identity-services-engine-insufficiently-protected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20234 · Severity: critical · CVSS 9.9 · Published 2026-09-16

Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain critical credential protection vulnerabilities discovered during internal security review. These appliances manage authentication, authorization, and accounting for enterprise networks. An attacker could potentially extract or misuse stored credentials, gaining unauthorized access to corporate systems and sensitive data.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco ISE Passive Identity Connector](https://junglewise.ai/threats/technologies/ise-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20234 being exploited in the wild.

**How severe is CVE-2026-20234?** Critical severity, with a CVSS score of 9.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine 3.0 and earlier; 3.1, 3.2, 3.3, 3.4, 3.5 (various patch levels affected); Cisco ISE Passive Identity Connector 3.4 and earlier.

**Is there a fix for CVE-2026-20234?** A patch was published on 2026-09-16: Fixed releases available: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20234 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20234?** Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20234 addresses insufficiently protected credentials (CWE-522) within a group of internally discovered vulnerabilities in Cisco ISE and ISE-PIC. The vulnerability allows unauthorized exposure or recovery of stored credentials, potentially through weak encoding, recoverable password storage, or similar authentication bypass mechanisms. The vulnerability is network-reachable and requires no authentication or user interaction to exploit. Attackers can extract credentials to gain unauthorized access to ISE and downstream systems. Cisco has released patched versions (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4) and recommends immediate upgrade; no workarounds are available.

## Affected products

- Cisco Identity Services Engine 3.0 and earlier; 3.1, 3.2, 3.3, 3.4, 3.5 (various patch levels affected)
- Cisco ISE Passive Identity Connector 3.4 and earlier

## Timeline

- 2026-09-16: disclosed: Public disclosure of CVE-2026-20234 and hardening release
- 2026-09-16: patched: Fixed releases available: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)