Cisco ISE: authorization bypass exposing endpoint certificates (CVE-2026-20241) fixed in 3.1 to 3.5 patches
Published 11/11/2026 20:12
Timeline
2 events over 7 d
- 04/11/2026 17:00ConfirmedCisco Security Advisories+7 d
- 11/11/2026 20:12Published on WatchtowerPro CISO
In short
Cisco Identity Services Engine (ISE) and ISE-PIC have an authorization flaw (CVE-2026-20241) that lets an unauthenticated attacker obtain an endpoint identity certificate over the network. Cisco rates it Medium (CVSS 5.3), has released fixed patches for branches 3.1 to 3.5 and offers no workaround. It is not on CISA's known-exploited list.
How bad is it
Medium. An attacker who can reach a vulnerable Cisco ISE system over the network can obtain an endpoint identity certificate without logging in, but nothing else is exposed.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from cisco.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read some of its data
Type: access control bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Cisco ISE and Cisco ISE-PIC, regardless of device configuration. Cisco does not list exact vulnerable versions and points to its fixed-release table (bug ID CSCwu26099).
- ISE-PIC has reached end-of-sale; release 3.4 is its last supported release.
Fixed in
- Cisco ISE 3.1 Patch 12
- Cisco ISE 3.2 Patch 11
- Cisco ISE 3.3 Patch 12
- Cisco ISE 3.4 Patch 7
- Cisco ISE 3.5 Patch 4
- The fixes are also in the Cisco ISE Hardening Release: September 2026.
What to do now
- Update Cisco ISE to the first fixed patch for your branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 (ISE-PIC: 3.4 is the last supported release).
- Cisco says these fixes are also part of the Cisco Identity Services Engine Hardening Release: September 2026.
- Cisco offers no workaround. Restricting network access to ISE to trusted hosts only reduces exposure and does not make the server safe; install the patch.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (I, at which version, fixed or not - and what each one needs.
Main sources
Cisco Identity Services Engine Authorization Bypass Vulnerability Vendor · Cisco Identity Services Engine Authorization Bypass Vulnerabilities Vendor · [NEU] [mittel] Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen CERT