VULNpocalypse
MediumVulnerabilityPatch available

Cisco discloses Identity Services Engine authorization bypass flaws

Cisco says three authorization bypass flaws in ISE could let an authenticated admin alter some settings; upgrade to a fixed patch.

Published
Fixed in
Cisco ISE 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4
Exploitation
No, Cisco PSIRT says it is not aware of public announcements or malicious use

Live scores

CVE-2026-20183
EPSS
0.005
low predicted chance of attack
VEDAS
0.056
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-20285
EPSS
0.005
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-20286
EPSS
0.005
low predicted chance of attack
VEDAS
0.057
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to Cisco’s Product Security Incident Response Team (PSIRT), multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration of an affected device. Cisco says the advisory (ID cisco-sa-ise-auth-bypass-1-MxcTNgwx) was first published on 2026-09-16 and last updated on 2026-11-10 Cisco PSIRT.

Cisco says the flaws are due to a lack of server-side validation of Administrator permissions, and that an attacker could submit a crafted HTTP request to an affected system. According to Cisco, a successful exploit could allow the attacker to modify descriptions of files on specific pages, and valid Administrator credentials are required. Cisco rates the advisory Medium, with a CVSS base score of 4.3, and classifies the weakness as CWE-285 Cisco PSIRT.

The CVE identifiers listed by Cisco are CVE-2026-20183, CVE-2026-20285 and CVE-2026-20286. Cisco says version 1.1 of the advisory (2026-11-10) added CVE-2026-20183. Cisco credits Adrian Michalczyk with reporting the vulnerabilities Cisco PSIRT.

Cisco says its PSIRT is not aware of any public announcements or malicious use of these vulnerabilities. This is Cisco’s statement only; no independent source was available to confirm or contradict it.

Am I affected?

According to Cisco:

  • CVE-2026-20286 and CVE-2026-20183 affected Cisco ISE regardless of device configuration. Cisco says they do not affect ISE-PIC.
  • CVE-2026-20285 affected Cisco ISE and Cisco ISE-PIC regardless of device configuration.
  • Cisco says only the products listed as vulnerable are known to be affected.

Cisco’s fixed-release table lists these first fixed releases for ISE and ISE-PIC:

ReleaseFirst fixed release
3.2 and earlierMigrate to a fixed release
3.33.3 Patch 12
3.43.4 Patch 7
3.53.5 Patch 4

Cisco notes that ISE-PIC has reached its end-of-sale date and that release 3.4 is the last supported release for it. Cisco says the Details section of each bug ID (CSCwt62639, CSCwt62644, CSCwt62645) holds the most complete and current information. Which CVE maps to which bug ID is not confirmed in the source Cisco PSIRT.

What to do now

  1. Identify which Cisco ISE and ISE-PIC releases and patch levels you run.
  2. If you are on 3.3, 3.4 or 3.5, upgrade to 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 respectively, following Cisco’s Upgrade Guides on the Cisco Identity Services Engine support page.
  3. If you are on 3.2 or earlier, Cisco says to migrate to a fixed release.
  4. Do not rely on a workaround: Cisco says none exists.
  5. Check the Details section of the Cisco bug IDs for the most current release information before you upgrade.

Sources