ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability

Timeline

Detection, updates, and resolution for this record.

1. Aug 13, 2026 · Catalog

   Detected

   This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20148.

Sources

• CVE.orgVulnerability recordCVE-2026-20148

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-20148

  30-day exploitation probability 6.5%

  first.org
• Zero Day InitiativeCoordinated disclosureZDI-26-582

  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20148.

  zerodayinitiative.com