Cisco ISE Authorization Bypass Vulnerability: Fix Guide
Cisco has patched an authorization flaw in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An unauthenticated, remote attacker could use it to obtain an endpoint identity certificate. T
Cisco has patched an authorization flaw in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An unauthenticated, remote attacker could use it to obtain an endpoint identity certificate. There are no workarounds, so patching is the fix.
What happened
Cisco published advisory cisco-sa-ise-cert-mE9BD5GO on 2026 November 4. It tracks the issue as CVE-2026-20241 (Cisco bug ID CSCwu26099, weakness type CWE-285, improper authorization).
The cause is improper authorization checks. An attacker sends a crafted request to an affected device. A successful request bypasses authorization and returns an endpoint certificate. Cisco credits independent researcher Nicholas Michael Kloster for the report. (Cisco advisory)
Who is affected and which release fixes it
Cisco ISE and ISE-PIC are affected regardless of device configuration. You cannot rule yourself out by turning a feature off.
Cisco lists these first fixed releases:
| ISE / ISE-PIC release | First fixed release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
ISE-PIC has reached its end-of-sale date. Release 3.4 is the last supported ISE-PIC release, so the 3.5 row applies to ISE only. Cisco also says these fixes are part of its broader advisory, Cisco Identity Services Engine Hardening Release: September 2026.
How serious it is and whether it is exploited
Cisco rates the flaw Medium with a CVSS base score of 5.3. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
In plain terms:
- Network attack: the attacker needs no local access.
- Low complexity: no special conditions are required.
- No privileges, no user action: nobody has to log in or click.
- Low confidentiality impact: no integrity or availability impact is scored.
Cisco PSIRT is not aware of any public announcements or malicious use. That can change after a disclosure, so treat the patch as routine but prompt. An ISE node often sits at the center of network access control, which is a good reason not to let it linger.
What to do now
1. Find your release and patch level
Check the release and installed patch level of every ISE node, including each node in a multi-node deployment. The exact steps depend on your version, so follow the Upgrade Guides on the Cisco Identity Services Engine support page. Then compare the result with the table above.
2. Work out your target
Here is a worked example. Say a node reports release 3.3 with Patch 9 installed. The first fixed release for 3.3 is Patch 12, so that node is exposed and needs Patch 12 or later. A node on 3.4 Patch 7 or higher is already covered.
| What you see | Action |
|---|---|
| Patch level at or above the table | No action for this CVE |
| Patch level below the table | Install the listed patch or a later one |
| Release not in the table, or ISE-PIC on 3.5 | Check the Cisco advisory and plan an upgrade path |
3. Install the patch
Follow the Upgrade Guides on the Cisco Identity Services Engine support page. In a multi-node deployment, patch nodes in the order those guides describe, and take a backup first.
4. Re-check and record
Check the release and patch level again on every node, using the same method as in step 1. Save the result with your change ticket. If you cannot patch this week, note the risk and a date. Cisco's advisory states that no workaround addresses this flaw.
5. Review access to ISE
Limiting which networks can reach ISE is good hygiene, though it does not replace the patch. Check firewall rules in front of your ISE nodes and confirm only the systems that need them can reach them.
6. Know when to contact Cisco TAC
Contact the Cisco Technical Assistance Center (TAC) in two cases. You bought directly from Cisco but hold no service contract. Or you bought through a third party and could not get fixed software from your point of sale. Have the product serial number and the advisory URL ready as evidence of entitlement to a free upgrade.
What learners can take from this
This advisory is a clean example of CWE-285 in the real world: a request reaches a function without a proper check on who is asking. It also shows why vulnerability management is a daily skill. You read an advisory, map releases to patch levels, verify the result and document it. The CS0-003 exam guide covers that workflow for security analysts.
Try it as practice. Take any advisory, build a table like the one above, and write your own verification checklist.
Want to turn that skill into a credential? Browse our cybersecurity certification vouchers.
Originally published at BuyExamVouchers.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.