CVE-2026-20071
LOW 3.8 ALL-YEARSA vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 3rd percentile
Impact if exploited
3.8CVSS 3.1 · LOW · CNA
- ConfidentialityNone
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Weakness (CWE)
- CWE-290: Authentication Bypass by Spoofing
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
All CVSS metrics
- LOW 3.8 v3.1 · CNA Primary
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - LOW 3.8 v3.1 · NVD Secondary
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N