CVE-2026-20193 — The RADIUS Policy API Endpoints Of Cisco ISE Vulnerability

title: Cisco ISE RADIUS Policy API Unauthorized Access - CVE-2026-20193
id: scw-2026-05-06-ai-1
status: experimental
level: high
description: |
  Detects direct access to Cisco ISE RADIUS Policy API endpoints (e.g., /api/v1/policies/radius) via GET requests, which is indicative of an attacker attempting to exploit CVE-2026-20193 to gain unauthorized read access to sensitive RADIUS Policy details. This bypasses the web-based management interface and targets the improper RBAC permissions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-20193/
tags:
  - attack.lateral_movement
  - attack.t1219
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v1/policies/radius'
      cs-method:
          - 'GET'
      sc-status:
          - '200'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse