{"id":"CVE-2026-20183","kind":"vulnerability","aliases":["CVE-2026-20183"],"related":[],"title":"Cisco ISE: authenticated admin can change file descriptions via web interface","description":"A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.\r\n\r\nThis vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials.","summary":"Cisco Identity Services Engine's web management interface lacks server-side checks on administrator permissions. An attacker with valid administrator credentials can send a crafted HTTP request to modify file descriptions on a specific page.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco-ise","infrastructure","self-hosted"],"not_affected_if":["no-admin-access-exposed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T23:17:21+00:00","first_seen_at":"2026-11-10T23:27:36+00:00","triaged_at":"2026-11-10T23:28:53+00:00","updated_at":"2026-11-10T23:28:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T23:28:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Cisco ISE: authenticated admin can change file descriptions via web interface","impact":"low","summary":"Cisco Identity Services Engine's web management interface lacks server-side checks on administrator permissions. An attacker with valid administrator credentials can send a crafted HTTP request to modify file descriptions on a specific page.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cisco-ise","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated admin modifies file descriptions on one management page","analyst_note":"Check Cisco's security advisory for affected ISE versions and fixed releases; the sources here give only the NVD description.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposed"],"who_is_affected":"Organizations running Cisco Identity Services Engine with its web-based management interface reachable by administrators. The attacker must already hold valid Administrator credentials, so the flaw adds little reach beyond existing admin access. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4649,"output_tokens":450,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-20183':14A,17A '-2026':13A,16A 'admin':4A 'administr':39B,45B,105C,148C 'affect':90C,121C 'allow':77C,127C 'attack':42B,81C,108C,129C,144C 'authent':3A,79C 'base':67C 'chang':6A 'check':37B 'cisco':1A,19B,25B,71C 'cisco-is':18B 'configur':87C 'could':76C,109C,126C 'craft':50B,116C 'credenti':46B,149C 'cve':12A,15A 'descript':8A,56B,132C 'devic':91C 'due':95C 'engin':28B,74C 'exploit':110C,125C,140C 'file':7A,55B,134C 'host':24B 'http':51B,117C 'ident':26B,72C 'infrastructur':21B 'interfac':11A,32B,69C 'ise':2A,20B,75C 'lack':33B,98C 'manag':31B,68C 'modifi':54B,83C,131C 'need':146C 'page':60B,138C 'part':84C 'permiss':40B,106C 'remot':80C 'request':52B,118C 'self':23B 'self-host':22B 'send':48B 'server':35B,101C 'server-sid':34B,100C 'servic':27B,73C 'side':36B,102C 'specif':59B,137C 'submit':114C 'success':124C 'system':122C 'valid':44B,103C,147C 'via':9A 'vulner':62C,93C,112C,142C 'web':10A,30B,66C 'web-bas':65C 'would':145C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Cisco Identity Services Engine with its web-based management interface reachable by administrators. The attacker must already hold valid Administrator credentials, so the flaw adds little reach beyond existing admin access. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ciscoise","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-20183':14A,17A '-2026':13A,16A 'admin':4A 'authent':3A 'chang':6A 'cisco':1A 'cve':12A,15A 'descript':8A 'file':7A 'interfac':11A 'ise':2A 'via':9A 'web':10A","search_b":"'administr':39B,45B 'attack':42B 'check':37B 'cisco':19B,25B 'cisco-is':18B 'craft':50B 'credenti':46B 'descript':56B 'engin':28B 'file':55B 'host':24B 'http':51B 'ident':26B 'infrastructur':21B 'interfac':32B 'ise':20B 'lack':33B 'manag':31B 'modifi':54B 'page':60B 'permiss':40B 'request':52B 'self':23B 'self-host':22B 'send':48B 'server':35B 'server-sid':34B 'servic':27B 'side':36B 'specif':59B 'valid':44B 'web':30B","search_c":"'administr':105C,148C 'affect':90C,121C 'allow':77C,127C 'attack':81C,108C,129C,144C 'authent':79C 'base':67C 'cisco':71C 'configur':87C 'could':76C,109C,126C 'craft':116C 'credenti':149C 'descript':132C 'devic':91C 'due':95C 'engin':74C 'exploit':110C,125C,140C 'file':134C 'http':117C 'ident':72C 'interfac':69C 'ise':75C 'lack':98C 'manag':68C 'modifi':83C,131C 'need':146C 'page':138C 'part':84C 'permiss':106C 'remot':80C 'request':118C 'server':101C 'server-sid':100C 'servic':73C 'side':102C 'specif':137C 'submit':114C 'success':124C 'system':122C 'valid':103C,147C 'vulner':62C,93C,112C,142C 'web':66C 'web-bas':65C 'would':145C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20183","severity":null,"published_at":"2026-11-10T23:17:21+00:00","modified_at":"2026-11-10T23:17:21+00:00","first_seen_at":"2026-11-10T23:27:36+00:00","fetched_at":"2026-11-10T23:27:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}