ISE 802.1x Session Hijack Vulnerability
Summary
| CVE | CVE-2026-20071 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-16 21:17:07 UTC |
| Updated | 2026-09-18 13:28:28 UTC |
| Description | A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network. |
Risk And Classification
Primary CVSS: v3.1 3.8 LOW from [email protected]
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
EPSS: 0.001460000 probability, percentile 0.042160000 (date 2026-09-20)
Problem Types: CWE-290 | CWE-290 Authentication Bypass by Spoofing
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 3.8 | LOW | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
| 3.1 | CNA | CVSSV3_1 | 3.8 | LOW | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
NoneIntegrity
LowAvailability
NoneCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mu... | [email protected] | sec.cloudapps.cisco.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Exploits
CNA: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
There are currently no legacy QID mappings associated with this CVE.