# Multiple Vulnerabilities in Cisco Identity Services Engine, ISE Passive Identity Connector, and RoomOS (GovCERT.HK A26-07-32)

> Cisco disclosed seven vulnerabilities on 15-17 July 2026 spanning Identity Services Engine (ISE)/ISE-PIC (an authenticated path-traversal flaw enabling arbitrary file read/delete) and RoomOS collaboration endpoint software (six internally-discovered hardening issues covering access control, input validation, buffer overflow, cleartext transmission, resource lifecycle, and exception-handling weaknesses). GovCERT.HK republished the bundle as standard alert A26-07-32. No public PoC or in-the-wild exploitation has been observed for any of the seven CVEs; Cisco has shipped patches/hot patches for all affected trains.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1500
- **ID:** TL-2026-1500
- **Severity:** MEDIUM (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20146, CVE-2026-20150, CVE-2026-20153, CVE-2026-20156, CVE-2026-20157, CVE-2026-20158, CVE-2026-20187

## Description

On 15-17 July 2026, Cisco published two coordinated security advisories covering seven CVEs across three product lines, which Hong Kong's GovCERT.HK bundled into standard-tier alert A26-07-32 on 17 July 2026.

The first advisory, cisco-sa-ise-traversal-xNt7wb2Y, discloses CVE-2026-20146, a path-traversal vulnerability (CWE-22) in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw stems from insufficient validation of user-supplied input in the web-based management interface's file-handling logic, allowing an authenticated attacker holding valid administrative credentials to send crafted HTTP requests that traverse outside the intended directory scope to read or delete arbitrary files on the underlying operating system. Exploitation requires prior authentication (PR:H) but no user interaction, giving a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N). Because ISE is frequently deployed as the policy/authentication backbone for 802.1X network access control, an attacker who has already obtained admin-level access could use this flaw to pivot into destructive file deletion or to read sensitive configuration/certificate material stored on the appliance filesystem, compounding an existing credential compromise. No workaround exists; fixed releases are 3.3 Patch 12, 3.4 Patch 7 (or hot patch), and 3.5 Patch 4 (or hot patch), all targeted for September 2026, with versions earlier than 3.3 requiring migration to a supported train.

The second advisory, cisco-sa-hardening-roomos-AqNMbEq, bundles six CVEs (CVE-2026-20150, -20153, -20156, -20157, -20158, -20187) found by Cisco's own RoomOS engineering team during an internal, AI-assisted security review of the RoomOS collaboration endpoint operating system (used on Cisco/Webex Room, Desk, and Board video devices). CVE-2026-20150 (CVSS 8.8, CWE-284 Improper Access Control) allows a low-privileged network attacker to bypass intended access restrictions with full confidentiality/integrity/availability impact. CVE-2026-20153 (CVSS 7.5, CWE-20 Improper Input Validation) is unauthenticated and network-exploitable, causing denial of service. CVE-2026-20156 (CVSS 8.1, CWE-119 memory-buffer bounds violation) requires high attack complexity but yields full CIA impact, consistent with a heap/stack overflow primitive in RoomOS media or signaling parsing code. CVE-2026-20157 (CVSS 7.5, CWE-311 Missing Encryption of Sensitive Data) requires adjacent-network positioning and high attack complexity, implying exposure of sensitive data (credentials, session tokens, or media streams) transmitted in cleartext to an attacker who can observe adjacent-segment traffic, e.g. the same local/room network. CVE-2026-20158 (CVSS 7.5, CWE-664 Improper Control of a Resource Through its Lifetime) and CVE-2026-20187 (CVSS 7.5, CWE-703 Improper Handling of Exceptional Conditions) are both unauthenticated, network-reachable denial-of-service vectors, likely triggerable via malformed call-signaling or media packets that RoomOS fails to release/handle cleanly, crashing or hanging the device. All six affect a broad matrix of RoomOS 10.3.2.0 through 11.38.1.1 (RoomOS 11 and earlier, on-prem and cloud-registered) and the RoomOS 26 branch through 26.5.2.0/26.7.1.7. No workarounds are available for any of the six; fixed releases are RoomOS 11.32.6.0 (on-prem) / 11.39.1.1 (cloud-aware), and RoomOS 26.5.2.2 (on-prem) / 26.7.1.7 (June 2026 cloud release).

GovCERT.HK's own publication conventions place this at the lower 'Security Alert' tier rather than 'High Threat Security Alert,' reflecting that none of the seven CVEs carry confirmed active exploitation, and CISA's Known Exploited Vulnerabilities catalog (checked 18 July 2026) contains no entries for any of the seven CVE IDs. The combined risk profile is nonetheless significant for defenders: ISE is core network-access-control infrastructure, and RoomOS devices are frequently deployed in boardrooms/executive spaces with microphones and cameras, making the CWE-311 cleartext-exposure and CWE-284 access-control bypass findings particularly sensitive from a confidentiality standpoint even absent a public exploit.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1123 Audio Capture
- T1125 Video Capture
- T1040 Network Sniffing
- T1499 Endpoint Denial of Service
- T1485 Data Destruction
- T1565 Data Manipulation
- T1489 Service Stop

## Sources

- [GovCERT.HK Security Alert A26-07-32](https://www.govcert.gov.hk/en/alerts_detail.php?id=1972)
- [Cisco Security Advisory: cisco-sa-ise-traversal-xNt7wb2Y](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y)
- [Cisco Security Advisory: cisco-sa-hardening-roomos-AqNMbEq](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq)
- [NVD - CVE-2026-20146](https://nvd.nist.gov/vuln/detail/CVE-2026-20146)
- [NVD - CVE-2026-20150](https://nvd.nist.gov/vuln/detail/CVE-2026-20150)
- [NVD - CVE-2026-20153](https://nvd.nist.gov/vuln/detail/CVE-2026-20153)
- [NVD - CVE-2026-20156](https://nvd.nist.gov/vuln/detail/CVE-2026-20156)
- [NVD - CVE-2026-20157](https://nvd.nist.gov/vuln/detail/CVE-2026-20157)
- [NVD - CVE-2026-20158](https://nvd.nist.gov/vuln/detail/CVE-2026-20158)
- [NVD - CVE-2026-20187](https://nvd.nist.gov/vuln/detail/CVE-2026-20187)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1500