CVE-2026-20071: ISE 802.1x Session Hijack Vulnerability
A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
Cisco ISE environments using the SSID BYOD onboarding workflow for access to protected 802.1X networks are the relevant scope.
What must an attacker be able to do to exploit this issue?
The attacker must be adjacent to the target environment and able to spoof a legitimate user while triggering a redirection to the guest web portal. No prior authentication is required.