Patch Cisco ISE bug now before attackers abuse proof-of-concept exploit

Cisco patched CVE-2026-20029, a medium-severity (CVSS 4.9) vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) caused by improper XML parsing in the web management interface; authenticated attackers with admin-level credentials could upload a malicious file to read arbitrary files on the underlying system. A public proof-of-concept exists, increasing the risk of exploitation, but vendors state they are not aware of active in-the-wild abuse and urge customers to apply the patch promptly.