CVE-2026-20241

Medium [CVE-2026-20241] Cisco Identity Services Engine Authorization Bypass Vulnerability

cisco-sa-ise-cert-mE9BD5GOSource published Nov 4, 2026Source updated Nov 4, 2026

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected products in this advisory

• ISE Passive Identity Connector
• Identity Services Engine Software

Source-reported affected versions

• Scope: At the time of publication, this vulnerability affected Cisco ISE and Cisco ISE-PIC, regardless of device configuration.
• Release 3.1 (first fixed: 3.1 Patch 12)
• Release 3.2 (first fixed: 3.2 Patch 11)
• Release 3.3 (first fixed: 3.3 Patch 12)

2 more entries in the full advisory.

Source-reported fixed versions

• 3.1 Patch 12
• 3.2 Patch 11
• 3.3 Patch 12
• 3.4 Patch 7

1 more entries in the full advisory.

Mitigation guidance

• Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
• Release 3.1: upgrade to 3.1 Patch 12.
• Release 3.2: upgrade to 3.2 Patch 11.
• Release 3.3: upgrade to 3.3 Patch 12.

2 more entries in the full advisory.

Workarounds

• There are no workarounds that address this vulnerability.

Advisory [CVE-2026-20241 +2] Cisco Advance Notification for Publication of November 4, 2026, Security Advisories

cisco-sa-notice-I8z3n6lKSource published Oct 28, 2026Source updated Oct 28, 2026

This bulletin covers 3 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco UCS Central Software Remote Code Execution Vulnerability High 7.6 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability Medium 6.1 Cisco Identity Services Engine Authorization Bypass Vulnerability 5.3 To remediate the vulnerabilities that were disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability information for the remainder of calendar year 2026. The next planned…

Affected products in this advisory

No product details extracted. Check the source bulletin.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.