Threat reportVulnerabilityTL-2026-1500
Multiple Vulnerabilities in Cisco Identity Services Engine, ISE Passive Identity Connector, and RoomOS (GovCERT.HK A26-07-32)
Multiple Vulnerabilities in Cisco Identity Services Engine (TL-2026-1500), also tracked as GovCERT.HK A26-07-32, is a medium-severity software vulnerability scored CVSS 8.8, first published 2026-07-18. It has no confirmed attribution, affects Cisco Identity Services Engine (ISE), references 7 CVEs (CVE-2026-20146, CVE-2026-20150, CVE-2026-20153), maps to 18 MITRE ATT&CK techniques (T1005, T1040, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
- CVSS
- 8.8/10Medium
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-1500
- Threat ID
- TL-2026-1500
- Also known as
- GovCERT.HK A26-07-32, cisco-sa-ise-traversal-xNt7wb2Y, cisco-sa-hardening-roomos-AqNMbEq
- Severity
- MEDIUM
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, technology, telecoms, enterprise-networking, corporate-collaboration
- Target regions
- Global, Asia Pacific, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 16
How Multiple Vulnerabilities in Cisco Identity Services Engine works
Cisco disclosed seven vulnerabilities on 15-17 July 2026 spanning Identity Services Engine (ISE)/ISE-PIC (an authenticated path-traversal flaw enabling arbitrary file read/delete) and RoomOS collaboration endpoint software (six internally-discovered hardening issues covering access control, input validation, buffer overflow, cleartext transmission, resource lifecycle, and exception-handling weaknesses). GovCERT.HK republished the bundle as standard alert A26-07-32. No public PoC or in-the-wild exploitation has been observed for any of the seven CVEs; Cisco has shipped patches/hot patches for all affected trains.
On 15-17 July 2026, Cisco published two coordinated security advisories covering seven CVEs across three product lines, which Hong Kong's GovCERT.HK bundled into standard-tier alert A26-07-32 on 17 July 2026.
The first advisory, cisco-sa-ise-traversal-xNt7wb2Y, discloses CVE-2026-20146, a path-traversal vulnerability (CWE-22) in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw stems from insufficient validation of user-supplied input in the web-based management interface's file-handling logic, allowing an authenticated attacker holding valid administrative credentials to send crafted HTTP requests that traverse outside the intended directory scope to read or delete arbitrary files on the underlying operating system. Exploitation requires prior authentication (PR:H) but no user interaction, giving a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N). Because ISE is frequently deployed as the policy/authentication backbone for 802.1X network access control, an attacker who has already obtained admin-level access could use this flaw to pivot into destructive file deletion or to read sensitive configuration/certificate material stored on the appliance filesystem, compounding an existing credential compromise. No workaround exists; fixed releases are 3.3 Patch 12, 3.4 Patch 7 (or hot patch), and 3.5 Patch 4 (or hot patch), all targeted for September 2026, with versions earlier than 3.3 requiring migration to a supported train.
The second advisory, cisco-sa-hardening-roomos-AqNMbEq, bundles six CVEs (CVE-2026-20150, -20153, -20156, -20157, -20158, -20187) found by Cisco's own RoomOS engineering team during an internal, AI-assisted security review of the RoomOS collaboration endpoint operating system (used on Cisco/Webex Room, Desk, and Board video devices). CVE-2026-20150 (CVSS 8.8, CWE-284 Improper Access Control) allows a low-privileged network attacker to bypass intended access restrictions with full confidentiality/integrity/availability impact. CVE-2026-20153 (CVSS 7.5, CWE-20 Improper Input Validation) is unauthenticated and network-exploitable, causing denial of service. CVE-2026-20156 (CVSS 8.1, CWE-119 memory-buffer bounds violation) requires high attack complexity but yields full CIA impact, consistent with a heap/stack overflow primitive in RoomOS media or signaling parsing code. CVE-2026-20157 (CVSS 7.5, CWE-311 Missing Encryption of Sensitive Data) requires adjacent-network positioning and high attack complexity, implying exposure of sensitive data (credentials, session tokens, or media streams) transmitted in cleartext to an attacker who can observe adjacent-segment traffic, e.g. the same local/room network. CVE-2026-20158 (CVSS 7.5, CWE-664 Improper Control of a Resource Through its Lifetime) and CVE-2026-20187 (CVSS 7.5, CWE-703 Improper Handling of Exceptional Conditions) are both unauthenticated, network-reachable denial-of-service vectors, likely triggerable via malformed call-signaling or media packets that RoomOS fails to release/handle cleanly, crashing or hanging the device. All six affect a broad matrix of RoomOS 10.3.2.0 through 11.38.1.1 (RoomOS 11 and earlier, on-prem and cloud-registered) and the RoomOS 26 branch through 26.5.2.0/26.7.1.7. No workarounds are available for any of the six; fixed releases are RoomOS 11.32.6.0 (on-prem) / 11.39.1.1 (cloud-aware), and RoomOS 26.5.2.2 (on-prem) / 26.7.1.7 (June 2026 cloud release).
GovCERT.HK's own publication conventions place this at the lower 'Security Alert' tier rather than 'High Threat Security Alert,' reflecting that none of the seven CVEs carry confirmed active exploitation, and CISA's Known Exploited Vulnerabilities catalog (checked 18 July 2026) contains no entries for any of the seven CVE IDs. The combined risk profile is nonetheless significant for defenders: ISE is core network-access-control infrastructure, and RoomOS devices are frequently deployed in boardrooms/executive spaces with microphones and cameras, making the CWE-311 cleartext-exposure and CWE-284 access-control bypass findings particularly sensitive from a confidentiality standpoint even absent a public exploit.
MITRE ATT&CK techniques used in TL-2026-1500
Collection
T1005 Data from Local System; T1123 Audio Capture; T1125 Video Capture
credential-access
Discovery
T1046 Network Service Discovery; T1083 File and Directory Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Impact
T1485 Data Destruction; T1489 Service Stop; T1499 Endpoint Denial of Service; T1565 Data Manipulation
Persistence
T1505 Server Software Component
Credential Access
Affected products and versions in Multiple Vulnerabilities in Cisco Identity Services Engine
- Cisco — Identity Services Engine (ISE)
Vulnerable versions: earlier than 3.3; 3.3 (prior to Patch 12); 3.4 (prior to Patch 7); 3.5 (prior to Patch 4)
Fixed in: 3.3 Patch 12; 3.4 Patch 7 or hot patch; 3.5 Patch 4 or hot patch - Cisco — Identity Services Engine Passive Identity Connector (ISE-PIC)
Vulnerable versions: earlier than 3.3; 3.3 (prior to Patch 12); 3.4 (prior to Patch 7); 3.5 (prior to Patch 4)
Fixed in: 3.3 Patch 12; 3.4 Patch 7 or hot patch; 3.5 Patch 4 or hot patch - Cisco — RoomOS (on-premises and cloud-registered Room/Desk/Board devices)
Vulnerable versions: 10.3.2.0 through 11.38.1.1 (RoomOS 11 and earlier); RoomOS 26 through 26.5.2.0
Fixed in: 11.32.6.0 (on-premises); 11.39.1.1 (cloud-aware); 26.5.2.2 (on-premises); 26.7.1.7 (June 2026 cloud release)
Remediation for Multiple Vulnerabilities in Cisco Identity Services Engine
Patches
- Cisco ISE 3.3: apply Patch 12 (target September 2026)
- Cisco ISE 3.4: apply Patch 7 or interim hot patch (target September 2026)
- Cisco ISE 3.5: apply Patch 4 or interim hot patch (target September 2026)
- Cisco ISE versions earlier than 3.3: migrate to a supported, fixed release train
- RoomOS 11 and earlier (on-premises): update to 11.32.6.0
- RoomOS 11 and earlier (cloud-aware): update to 11.39.1.1
- RoomOS 26 (on-premises): update to 26.5.2.2
- RoomOS 26 (cloud): update to the June 2026 release, 26.7.1.7
Immediate actions
- Inventory all Cisco ISE, ISE-PIC, and RoomOS (Room/Desk/Board device) deployments and identify current software versions
- Prioritize patching Cisco ISE/ISE-PIC nodes that expose the web administration interface to any untrusted or broadly-privileged user population
- Prioritize patching RoomOS endpoints reachable from guest, BYOD, or less-trusted network segments given multiple unauthenticated network-vector CVEs
- Restrict Cisco ISE administrative interface access to a dedicated management network/jump host and enforce MFA on admin accounts to reduce the value of the CVE-2026-20146 authenticated-attacker precondition
- Monitor ISE admin audit logs for anomalous file access/deletion activity or unexpected admin-session file-path parameters
Workarounds
- No workarounds are available for CVE-2026-20146 (ISE path traversal)
- No workarounds are available for any of the six RoomOS CVEs (CVE-2026-20150, -20153, -20156, -20157, -20158, -20187)
Longer-term hardening
- Segment RoomOS/Webex device VLANs away from adjacent-network access by untrusted parties to mitigate CWE-311 cleartext-exposure risk (CVE-2026-20157)
- Establish a recurring Cisco PSIRT advisory review cadence for ISE and collaboration endpoint product lines
- Adopt least-privilege administrative role assignment within Cisco ISE to reduce the blast radius of any single compromised admin credential
- Deploy network intrusion detection signatures for anomalous RoomOS signaling/media traffic patterns consistent with malformed-packet DoS attempts
CVEs associated with Multiple Vulnerabilities in Cisco Identity Services Engine
CVE-2026-20146, CVE-2026-20150, CVE-2026-20153, CVE-2026-20156, CVE-2026-20157, CVE-2026-20158, CVE-2026-20187
Weaknesses (CWE) in Multiple Vulnerabilities in Cisco Identity Services Engine
Timeline of Multiple Vulnerabilities in Cisco Identity Services Engine
- Cisco ships the RoomOS 26.7.1.7 'June 2026' cloud-aware release, which — per the later 15 July advisory — already contains the fix for all six RoomOS CVEs, indicating the fix was rolled into the normal cloud release train ahead of public disclosure.
- NVD publishes all seven CVE records (CVE-2026-20146, -20150, -20153, -20156, -20157, -20158, -20187) associated with the Cisco ISE and RoomOS vulnerabilities.
- Cisco publishes security advisory cisco-sa-hardening-roomos-AqNMbEq (first published 16:00 GMT, Version 1.0) disclosing six RoomOS vulnerabilities (CVE-2026-20150, -20153, -20156, -20157, -20158, -20187) discovered internally via 'existing testing processes and frontier AI models,' with fixed-release guidance.
- Cisco publishes security advisory cisco-sa-ise-traversal-xNt7wb2Y (first published 16:00 GMT, Version 1.0) disclosing CVE-2026-20146, the ISE/ISE-PIC path-traversal vulnerability, with patch guidance.
- Cisco's cisco-sa-ise-traversal-xNt7wb2Y advisory credits external researcher Jonathan Lein of TrendAI Research with reporting CVE-2026-20146, indicating responsible disclosure through Cisco PSIRT rather than in-the-wild discovery.
- CISA Known Exploited Vulnerabilities catalog checked; contains no entries for any of the seven CVE IDs, corroborating the absence of confirmed active exploitation.
- GovCERT.HK issues standard-tier Security Alert A26-07-32 summarizing both Cisco advisories for Hong Kong constituents, explicitly at the lower 'Security Alert' tier rather than 'High Threat Security Alert.'
- TL-Intel-Harness RESEARCH phase cross-references NVD, the CISA KEV catalog, and both Cisco advisories directly; confirms no known public exploitation or PoC exists for any of the seven CVEs as of this date.
- Target month for Cisco ISE 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 maintenance releases addressing CVE-2026-20146 (interim hot patches available for 3.4/3.5 ahead of this date).
Sources cited for Multiple Vulnerabilities in Cisco Identity Services Engine
- GovCERT.HK Security Alert A26-07-32
- Cisco Security Advisory: cisco-sa-ise-traversal-xNt7wb2Y
- Cisco Security Advisory: cisco-sa-hardening-roomos-AqNMbEq
- NVD - CVE-2026-20146
- NVD - CVE-2026-20150
- NVD - CVE-2026-20153
- NVD - CVE-2026-20156
- NVD - CVE-2026-20157
- NVD - CVE-2026-20158
- NVD - CVE-2026-20187
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-1500
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1500 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.