{"api_version":"1","generated_at":"2026-10-26T08:44:15+00:00","cve":"CVE-2026-20071","urls":{"html":"https://cve.report/CVE-2026-20071","api":"https://cve.report/api/cve/CVE-2026-20071.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-20071","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-20071"},"summary":{"title":"ISE 802.1x Session Hijack Vulnerability","description":"A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks.  \r\n\r\nThis vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.","state":"PUBLISHED","assigner":"cisco","published_at":"2026-09-16 21:17:07","updated_at":"2026-09-18 13:28:28"},"problem_types":["CWE-290","CWE-290 Authentication Bypass by Spoofing"],"metrics":[{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"3.8","severity":"LOW","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSSV3_1","score":"3.8","severity":"LOW","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-kWLeNnRD","name":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-kWLeNnRD","refsource":"psirt@cisco.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20071","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20071","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2.0 p7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 9","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.5 Patch 2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 11","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.4 Patch 6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.2 Patch 10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p72","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.1.0 p11","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Identity Services Engine Software","version":"affected 3.3 Patch 12","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"20071","cve":"CVE-2026-20071","epss":"0.001460000","percentile":"0.042160000","score_date":"2026-09-20","updated_at":"2026-09-21 00:10:10"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-20071","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T14:05:27.110491Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-17T14:05:45.971Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco Identity Services Engine Software","vendor":"Cisco","versions":[{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.1.0 p1"},{"status":"affected","version":"3.1.0 p3"},{"status":"affected","version":"3.1.0 p2"},{"status":"affected","version":"3.2.0"},{"status":"affected","version":"3.1.0 p4"},{"status":"affected","version":"3.1.0 p5"},{"status":"affected","version":"3.2.0 p1"},{"status":"affected","version":"3.1.0 p6"},{"status":"affected","version":"3.2.0 p2"},{"status":"affected","version":"3.1.0 p7"},{"status":"affected","version":"3.3.0"},{"status":"affected","version":"3.2.0 p3"},{"status":"affected","version":"3.2.0 p4"},{"status":"affected","version":"3.1.0 p8"},{"status":"affected","version":"3.2.0 p5"},{"status":"affected","version":"3.2.0 p6"},{"status":"affected","version":"3.1.0 p9"},{"status":"affected","version":"3.3 Patch 2"},{"status":"affected","version":"3.3 Patch 1"},{"status":"affected","version":"3.3 Patch 3"},{"status":"affected","version":"3.4.0"},{"status":"affected","version":"3.2.0 p7"},{"status":"affected","version":"3.3 Patch 4"},{"status":"affected","version":"3.4 Patch 1"},{"status":"affected","version":"3.1.0 p10"},{"status":"affected","version":"3.3 Patch 5"},{"status":"affected","version":"3.3 Patch 6"},{"status":"affected","version":"3.4 Patch 2"},{"status":"affected","version":"3.3 Patch 7"},{"status":"affected","version":"3.4 Patch 3"},{"status":"affected","version":"3.5.0"},{"status":"affected","version":"3.4 Patch 4"},{"status":"affected","version":"3.3 Patch 8"},{"status":"affected","version":"3.2 Patch 8"},{"status":"affected","version":"3.5 Patch 1"},{"status":"affected","version":"3.3 Patch 9"},{"status":"affected","version":"3.2 Patch 9"},{"status":"affected","version":"3.4 Patch 5"},{"status":"affected","version":"3.5 Patch 3"},{"status":"affected","version":"3.5 Patch 2"},{"status":"affected","version":"3.3 Patch 10"},{"status":"affected","version":"3.3 Patch 11"},{"status":"affected","version":"3.4 Patch 6"},{"status":"affected","version":"3.2 Patch 10"},{"status":"affected","version":"3.1.0 p72"},{"status":"affected","version":"3.1.0 p11"},{"status":"affected","version":"3.3 Patch 12"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks.  \r\n\r\nThis vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"Authentication Bypass by Spoofing","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-09-16T20:20:46.923Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-ise-multi-vuln-kWLeNnRD","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-kWLeNnRD"}],"source":{"advisory":"cisco-sa-ise-multi-vuln-kWLeNnRD","defects":["CSCwp98022"],"discovery":"EXTERNAL"},"title":"ISE 802.1x Session Hijack Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-20071","datePublished":"2026-09-16T20:20:46.923Z","dateReserved":"2025-10-08T11:59:15.357Z","dateUpdated":"2026-09-17T14:05:45.971Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 21:17:07","lastModifiedDate":"2026-09-18 13:28:28","problem_types":["CWE-290","CWE-290 Authentication Bypass by Spoofing"],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-17T14:05:27.110491Z","id":"CVE-2026-20071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"20071","Ordinal":"1","Title":"ISE 802.1x Session Hijack Vulnerability","CVE":"CVE-2026-20071","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"20071","Ordinal":"1","NoteData":"A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks.  \r\n\r\nThis vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.","Type":"Description","Title":"ISE 802.1x Session Hijack Vulnerability"}]}}}