SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20192

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score35/100 — MITTEL
  • CVSS 10 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

Erkennung & Indikatoren

Ausnutzung

One of the vulnerabilities addressed in this hardening release is known to be actively exploited.

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "ise.exe" or InitiatingProcessFileName =~ "isepic.exe"
| where ProcessCommandLine contains "access control bypass" or ProcessCommandLine contains "privilege escalation"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

(source="*ise.log" OR source="*isepic.log") (("access control bypass" OR "privilege escalation") OR ("authentication bypass" OR "authorization bypass")) | table _time, host, source, _raw

Sigma

title: Cisco ISE Improper Access Control
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential improper access control attempts on Cisco ISE or ISE-PIC.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\ise.exe'
      - '\isepic.exe'
    CommandLine|contains:
      - 'access control bypass'
      - 'privilege escalation'
      - 'authentication bypass'
      - 'authorization bypass'
  condition: selection
level: high

Elastic ES|QL

from process where process.parent.executable in ("ise.exe", "isepic.exe") and (process.command_line : "access control bypass" or process.command_line : "privilege escalation" or process.command_line : "authentication bypass" or process.command_line : "authorization bypass")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen