A remote, unauthenticated attacker can exploit an identity management API endpoint by sending crafted requests and observing whether the responses differ. This differential response reveals whether a username is valid, allowing the adversary to construct a full list of legitimate accounts on the device. The vulnerability is caused by information disclosure through variable error messages (CWE-204). The primary impact is the compromise of confidentiality through unchecked enumeration, which can serve as a stepping stone to more invasive attacks such as privilege escalation or credential harvesting.

The vulnerability affects Cisco Identity Services Engine Software. Specific product versions are not listed in the advisory, so any build prior to the issued fix is potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting limited data on exploitation frequency. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can exploit the flaw over the network, without authentication, by targeting the exposed API endpoint and interpreting error messages. Because the attack requires only standard HTTP(S) requests, the exploit is relatively easy to craft, but no known active exploitation is reported at this time.