Vulnerability · Published Sep 16, 2026 · Assigned by cisco
CVE-2026-20071ISE 802.1x Session Hijack Vulnerability
Low 3.8
In plain English
A low-severity authentication bypass by spoofing in Cisco Identity Services Engine Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 3.1.03.1.0 p13.1.0 p33.1.0 p23.2.03.1.0 p43.1.0 p53.2.0 p1 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N