Cisco ISE and ISE-PIC can issue an endpoint identity certificate to an unauthenticated remote attacker through an authorization bypass, regardless of configuration. Cisco lists patches across five ISE branches and reports no known malicious use; this is not a confirmed server takeover or universal network-access bypass.
Cisco attributes the flaw to improper authorization checks. The verified outcome is obtaining an endpoint identity certificate; the advisory does not specify which networks would trust that certificate or prove arbitrary access to every relying service. L3 reflects an unauthenticated flaw in a mainstream identity platform, not confirmed exploitation.
The advisory says these fixes are also included in the September 2026 ISE hardening release. That earlier packaging does not change this flaw’s November 4 public disclosure date. Upgrade using the supported procedure for the actual branch; do not confuse this certificate issue with separate ISE command-execution vulnerabilities.
CVE-2026-20241CVSS 5.3A crafted remote request bypasses authorization to obtain an endpoint identity certificate without authentication. Cisco assigns CVSS 3.1 5.3; the advisory does not establish arbitrary server execution or every downstream certificate privilege.
| Product | Safe from | Note |
|---|---|---|
| Cisco ISE / ISE-PIC 3.1 | 3.1 Patch 12 | First fixed patch listed by Cisco; ISE-PIC ends at 3.4 |
| Cisco ISE / ISE-PIC 3.2 | 3.2 Patch 11 | First fixed patch listed by Cisco; ISE-PIC ends at 3.4 |
| Cisco ISE / ISE-PIC 3.3 | 3.3 Patch 12 | First fixed patch listed by Cisco; ISE-PIC ends at 3.4 |
| Cisco ISE / ISE-PIC 3.4 | 3.4 Patch 7 | First fixed patch listed by Cisco; ISE-PIC ends at 3.4 |
| Cisco ISE 3.5 | 3.5 Patch 4 | First fixed patch listed by Cisco; no ISE-PIC 3.5 release |
Nov 4, 16:00 UTC
Cisco publishes the authorization-bypass advisory
ISE and ISE-PIC are affected regardless of configuration; Cisco provides fixed patches and no workaround. The 19:56 UTC revision only adds the researcher’s middle name.
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.