Cisco published advisory cisco-sa-ise-cert-mE9BD5GO on 4 November 2026. It covers CVE-2026-20241, a Cisco ISE authorization bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An unauthenticated remote attacker could send a crafted request and obtain an endpoint identity certificate. Cisco lists no workaround, so the action is to install the patch level for your release.
Cisco rates the flaw Medium. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), which means a Low confidentiality impact and nothing else. The advisory gives no CVSS 4.0 score. In our view the Medium rating should not delay patching: Cisco lists no workaround, and ISE is the policy engine many networks use to decide which endpoints may connect.
- Fixed releasesYesPatch levels for ISE 3.1 to 3.54 Nov 2026
- WorkaroundNot seenCisco says upgrading is the remediation4 Nov 2026
- Login needed to reach the flawNot seenUnauthenticated remote attacker4 Nov 2026
- Depends on configurationNot seenISE and ISE-PIC were affected regardless of device configuration at publication4 Nov 2026
- ExploitationUnknownCisco PSIRT says it is not aware of public announcements or malicious use4 Nov 2026
Which ISE Patch Level Fixes It?
Cisco gives one first fixed release for each release train. If you run an earlier patch level of the same train, you are below the fix.
| Release train | First fixed release | Note |
|---|---|---|
| 3.1 | 3.1 Patch 12 | Applies to ISE and ISE-PIC |
| 3.2 | 3.2 Patch 11 | Applies to ISE and ISE-PIC |
| 3.3 | 3.3 Patch 12 | Applies to ISE and ISE-PIC |
| 3.4 | 3.4 Patch 7 | Last supported release for ISE-PIC |
| 3.5 | 3.5 Patch 4 | ISE-PIC has reached end-of-sale |
Cisco says the same fixes are included in its ISE hardening advisory of September 2026, cisco-sa-hardening-ise-XU5EwX5T. For the latest affected-release detail, Cisco points to bug ID CSCwu26099.
What Does the Advisory Tell Us About the Bug?
Cisco attributes the flaw to improper authorization checks (CWE-285) in the authorization mechanism. The request needs no account. The independent researcher Nicholas Michael Kloster reported it.
The advisory does not name the interface, the certificate type or what the certificate could be used for. Anything beyond that is our estimate: a certificate issued to a party that should not have one could be presented as an endpoint identity wherever your policies trust it. If an ISE node reachable from untrusted networks were abused, we would map it to Exploit Public-Facing Application.
What Should ISE Administrators Do Today?
- List every ISE and ISE-PIC node and its patch level, from the administration console or the CLI command
show version. - Install the first fixed patch for your train, following Cisco’s upgrade guide for node order. ISE-PIC on 3.5 is not an option, because 3.4 is its last supported release.
- Limit which networks can reach ISE nodes to administrator ranges and your network devices. This reduces exposure but does not fix the flaw.
- Compare the endpoint certificates your ISE deployment has issued with your device inventory, and revoke any you cannot match.
- Review web access logs on ISE nodes for unauthenticated requests from unexpected sources, since the record does not say which interface is involved.
Cisco states only the upgrade. Steps 3 to 5 are our advice, and our patch management glossary entry covers how to order such work.
What Else Did Cisco Publish on 4 November?
Cisco’s advance notice lists three advisories for the day. Besides this one, they are Cisco UCS Central Software remote code execution (CVE-2026-76506, High, CVSS 7.6) and Cisco Unified Communications Manager cross-site scripting (CVE-2026-76419, Medium, CVSS 6.1). The notice does not list versions, so read each advisory before you plan.
Separately, Cisco’s Node.js and Brotli advisory (version 1.5, 4 November) lists ISE as Not Impacted and ISE-PIC as not vulnerable. That list is unrelated to this patch. For earlier Cisco edge fixes, see our Cisco ASA and FTD VPN denial-of-service post and the Cisco Vulnerability Tracker.