CVE-2026-20241 with a CVSS score of 5.3 is a vulnerability in the authorization mechanism of Cisco ISE and Cisco ISE-PIC, regardless of device configuration. It is an authorization bypass caused by improper authorization checks in the endpoint certificate issuance process. An unauthenticated remote attacker can exploit it by sending a crafted request to an affected device, without prior access or user interaction, and bypass authorization to obtain an endpoint identity certificate. The affected components are the identity services engine and its passive identity connector, which support endpoint authentication and access decisions. The business impact is that an attacker could acquire endpoint identity certificates, potentially undermining trust in identity-based access control, enabling unauthorized network access, impersonation of legitimate endpoints, or disruption of access management workflows. Because the flaw can be triggered remotely without authentication, organizations relying on these products for endpoint identity assurance may face increased risk of certificate misuse, loss of access control integrity, and operational exposure if compromised certificates are used to reach protected resources.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-20241 with a CVSS score of 5.3 is a vulnerability in the authorization mechanism of Cisco ISE and Cisco ISE-PIC, regardless of device configuration. It is an authorization bypass caused by improper authorization checks in the endpoint certificate issuance process. An unauthenticated remote attacker can exploit it by sending a crafted request to an affected device, without prior access or user interaction, and bypass authorization to obtain an endpoint identity certificate. The affected components are the identity services engine and its passive identity connector, which support endpoint authentication and access decisions. The business impact is that an attacker could acquire endpoint identity certificates, potentially undermining trust in identity-based access control, enabling unauthorized network access, impersonation of legitimate endpoints, or disruption of access management workflows. Because the flaw can be triggered remotely without authentication, organizations relying on these products for endpoint identity assurance may face increased risk of certificate misuse, loss of access control integrity, and operational exposure if compromised certificates are used to reach protected resources.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]