Cisco Identity Services Engine Authorization Bypass Vulnerability

Description

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO Security Impact Rating: Medium CVE: CVE-2026-20241

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Cisco Identity Services Engine

CVE

CVE-2026-20241

Affected versions

Cisco Identity Services Engine Software 3.1: 12 versions, from 3.1.0 to 3.1.0 p11
Cisco Identity Services Engine Software 3.2: 11 versions, from 3.2.0 to 3.2 Patch 10
Cisco Identity Services Engine Software 3.3: 12 versions, from 3.3.0 to 3.3 Patch 11
Cisco Identity Services Engine Software 3.4: 7 versions, from 3.4.0 to 3.4 Patch 6
Cisco Identity Services Engine Software 3.5: 4 versions, from 3.5.0 to 3.5 Patch 2
Cisco ISE Passive Identity Connector 3.2: 3.2.0
Cisco ISE Passive Identity Connector 3.1: 3.1.0
Cisco ISE Passive Identity Connector 3.3: 3.3.0
Cisco ISE Passive Identity Connector 3.4: 3.4.0
Cisco ISE Passive Identity Connector 3.5: 3.5.0 (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

not yet available

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

November 4, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.