CVE-2026-20195 — An Identity Management API Endpoint Of Cisco ISE Vulnerability

title: Cisco ISE Identity Management API User Enumeration Attempt — CVE-2026-20195
id: scw-2026-05-06-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-20195 by targeting the identity management API endpoint in Cisco ISE. The vulnerability allows unauthenticated attackers to enumerate valid user accounts by observing differentiated error messages in response to crafted requests to specific API paths, such as '/api/identity/users'. This rule specifically looks for GET requests to this path that result in a '400 Bad Request' status code, which can indicate a malformed request indicative of an enumeration attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-20195/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/identity/users'
      cs-method:
          - 'GET'
      sc-status:
          - '400'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse