CVE-2026-20241 PUBLISHED

Cisco Identity Services Engine Authorization Bypass Vulnerability

Assigner: cisco
Reserved: 08.10.2025 Published: 04.11.2026 Updated: 04.11.2026

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate.

This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor Cisco
Product Cisco Identity Services Engine Software
Versions Default: unknown
  • Version 3.1.0 is affected
  • Version 3.1.0 p1 is affected
  • Version 3.1.0 p3 is affected
  • Version 3.1.0 p2 is affected
  • Version 3.2.0 is affected
  • Version 3.1.0 p4 is affected
  • Version 3.1.0 p5 is affected
  • Version 3.2.0 p1 is affected
  • Version 3.1.0 p6 is affected
  • Version 3.2.0 p2 is affected
  • Version 3.1.0 p7 is affected
  • Version 3.3.0 is affected
  • Version 3.2.0 p3 is affected
  • Version 3.2.0 p4 is affected
  • Version 3.1.0 p8 is affected
  • Version 3.2.0 p5 is affected
  • Version 3.2.0 p6 is affected
  • Version 3.1.0 p9 is affected
  • Version 3.3 Patch 2 is affected
  • Version 3.3 Patch 1 is affected
  • Version 3.3 Patch 3 is affected
  • Version 3.4.0 is affected
  • Version 3.2.0 p7 is affected
  • Version 3.3 Patch 4 is affected
  • Version 3.4 Patch 1 is affected
  • Version 3.1.0 p10 is affected
  • Version 3.3 Patch 5 is affected
  • Version 3.3 Patch 6 is affected
  • Version 3.4 Patch 2 is affected
  • Version 3.3 Patch 7 is affected
  • Version 3.4 Patch 3 is affected
  • Version 3.5.0 is affected
  • Version 3.4 Patch 4 is affected
  • Version 3.3 Patch 8 is affected
  • Version 3.2 Patch 8 is affected
  • Version 3.5 Patch 1 is affected
  • Version 3.3 Patch 9 is affected
  • Version 3.2 Patch 9 is affected
  • Version 3.4 Patch 5 is affected
  • Version 3.5 Patch 3 is affected
  • Version 3.5 Patch 2 is affected
  • Version 3.3 Patch 10 is affected
  • Version 3.3 Patch 11 is affected
  • Version 3.4 Patch 6 is affected
  • Version 3.2 Patch 10 is affected
  • Version 3.1.0 p11 is affected
Vendor Cisco
Product Cisco ISE Passive Identity Connector
Versions Default: unknown
  • Version 3.2.0 is affected
  • Version 3.1.0 is affected
  • Version 3.3.0 is affected
  • Version 3.4.0 is affected
  • Version 3.5.0 is affected

Exploits

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References

Problem Types

  • Improper Authorization cwe