CVE-2026-20241 could allow an unauthenticated remote attacker to obtain an endpoint identity certificate through a crafted request to Cisco ISE or ISE-PIC. Rated Medium: CVSS 3.1, 5.3. CVE record.
Published 4 November 2026 at 16:00 UTC; updated 19:56. Vulnerable installations are affected in every configuration; no workaround exists. Fixes were included in September hardening. At our 5 November, 01:58 UTC check, PSIRT reported no known malicious use of this CVE. That is not proof of safety. Cisco advisory.
Match the installed patch
The September hardening advisory lists these first fixed releases:
- 3.1: Patch 12
- 3.2: Patch 11
- 3.3: Patch 12
- 3.4: Patch 7
- 3.5: Patch 4, ISE only
ISE-PIC is past end of sale; 3.4 is its last supported release. Cisco also recommends migrating ISE 3.1 and 3.2 to a supported release with all available hardening fixes.
Make the change measurable
Use a short change record rather than a general “updated” status. A product version without its patch number leaves the comparison unfinished.
- Inventory every node. Record the product, release branch and installed patch number. Keep the evidence with the change ticket.
- Choose the destination deliberately. Compare the inventory with the current vendor advisory and check the supported upgrade path for that deployment.
- Prepare recovery. Confirm a usable backup, maintenance ownership and the tests that will determine whether the change succeeded.
- Verify afterward. Recheck the installed patch on each node, then test representative certificate and authentication workflows. Record exceptions instead of marking the whole deployment complete.
The useful outcome is a verified deployment state and a repeatable check for the next advisory.