Does an attacker need to log in to ISE to exploit CVE-2026-20241?

No. Cisco describes the attacker as unauthenticated and remote. The attack works by sending a crafted request to an affected device.

Is Cisco ISE safe if I disable certain features?

Cisco says ISE and ISE-PIC are affected regardless of device configuration. Disabling features is not listed as a fix, and the advisory states there are no workarounds.

Is a Medium score a reason to delay patching ISE?

A 5.3 score reflects low confidentiality impact and no scored integrity or availability impact. Still, the flaw needs no login and no user action, and ISE is a central access-control system. Schedule the patch in your next normal maintenance window, or sooner if you can.

Does Cisco say this flaw is being exploited?

Cisco PSIRT says it is not aware of any public announcements or malicious use. Watch the advisory page for revisions in case that changes.

Which ISE release is the last one for ISE-PIC?

Cisco notes that ISE-PIC has reached its end-of-sale date. Release 3.4 is the last supported release, and the fixed version for it is 3.4 Patch 7.

Cisco ISE Authorization Bypass Vulnerability: Fix Guide

Cisco has patched an authorization flaw in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An unauthenticated, remote attacker could use it to obtain an endpoint identity certificate. There are no workarounds, so patching is the fix.

What happened

Cisco published advisory cisco-sa-ise-cert-mE9BD5GO on 2026 November 4. It tracks the issue as CVE-2026-20241 (Cisco bug ID CSCwu26099, weakness type CWE-285, improper authorization).

The cause is improper authorization checks. An attacker sends a crafted request to an affected device. A successful request bypasses authorization and returns an endpoint certificate. Cisco credits independent researcher Nicholas Michael Kloster for the report. (Cisco advisory)

Who is affected and which release fixes it

Cisco ISE and ISE-PIC are affected regardless of device configuration. You cannot rule yourself out by turning a feature off.

Cisco lists these first fixed releases:

ISE / ISE-PIC release	First fixed release
3.1	3.1 Patch 12
3.2	3.2 Patch 11
3.3	3.3 Patch 12
3.4	3.4 Patch 7
3.5	3.5 Patch 4

ISE-PIC has reached its end-of-sale date. Release 3.4 is the last supported ISE-PIC release, so the 3.5 row applies to ISE only. Cisco also says these fixes are part of its broader advisory, Cisco Identity Services Engine Hardening Release: September 2026.

How serious it is and whether it is exploited

Cisco rates the flaw Medium with a CVSS base score of 5.3. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

In plain terms:

Network attack: the attacker needs no local access.
Low complexity: no special conditions are required.
No privileges, no user action: nobody has to log in or click.
Low confidentiality impact: no integrity or availability impact is scored.

Cisco PSIRT is not aware of any public announcements or malicious use. That can change after a disclosure, so treat the patch as routine but prompt. An ISE node often sits at the center of network access control, which is a good reason not to let it linger.

What to do now

1. Find your release and patch level

Check the release and installed patch level of every ISE node, including each node in a multi-node deployment. The exact steps depend on your version, so follow the Upgrade Guides on the Cisco Identity Services Engine support page. Then compare the result with the table above.

2. Work out your target

Here is a worked example. Say a node reports release 3.3 with Patch 9 installed. The first fixed release for 3.3 is Patch 12, so that node is exposed and needs Patch 12 or later. A node on 3.4 Patch 7 or higher is already covered.

What you see	Action
Patch level at or above the table	No action for this CVE
Patch level below the table	Install the listed patch or a later one
Release not in the table, or ISE-PIC on 3.5	Check the Cisco advisory and plan an upgrade path

3. Install the patch

Follow the Upgrade Guides on the Cisco Identity Services Engine support page. In a multi-node deployment, patch nodes in the order those guides describe, and take a backup first.

4. Re-check and record

Check the release and patch level again on every node, using the same method as in step 1. Save the result with your change ticket. If you cannot patch this week, note the risk and a date. Cisco's advisory states that no workaround addresses this flaw.

5. Review access to ISE

Limiting which networks can reach ISE is good hygiene, though it does not replace the patch. Check firewall rules in front of your ISE nodes and confirm only the systems that need them can reach them.

6. Know when to contact Cisco TAC

Contact the Cisco Technical Assistance Center (TAC) in two cases. You bought directly from Cisco but hold no service contract. Or you bought through a third party and could not get fixed software from your point of sale. Have the product serial number and the advisory URL ready as evidence of entitlement to a free upgrade.

What learners can take from this

This advisory is a clean example of CWE-285 in the real world: a request reaches a function without a proper check on who is asking. It also shows why vulnerability management is a daily skill. You read an advisory, map releases to patch levels, verify the result and document it. The CS0-003 exam guide covers that workflow for security analysts.

Try it as practice. Take any advisory, build a table like the one above, and write your own verification checklist.

Want to turn that skill into a credential? Browse our cybersecurity certification vouchers.

Sources

Cisco Identity Services Engine Authorization Bypass Vulnerability (cisco-sa-ise-cert-mE9BD5GO)