rootpwn

low · CVSS v3 3.8

CVE-2026-20071

A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticat

Overview

A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to hijack an active onboarding session. The flaw results from insufficient authentication checks during the device onboarding phase. Exploitation enables the attacker to gain unauthorized access to protected 802.1X enterprise networks.

Description

A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are performed while a user is being onboarded. An attacker could exploit this vulnerability by spoofing the legitimate user and triggering a redirection to the guest web portal. A successful exploit could allow the attacker to take over the user session and gain access to the protected 802.1X network.

Impact

Adjacent attackers can take over user sessions during onboarding to gain unauthorized entry into 802.1X protected networks, compromising network access controls, confidentiality, and integrity.

Remediation

Apply software updates from Cisco to patched versions of Cisco ISE. In the interim, ensure network segmentation limits exposure on guest and onboarding VLANs, and monitor adjacent network traffic for unexpected web portal redirections.

Risk context

Assessed with a Low severity (CVSS v3: 3.8) because exploitation requires the attacker to be on the same physical or logical network segment (adjacent vector) and accurately time the attack during an active user onboarding event.

Affected products

  • Cisco Identity Services Engine (ISE)

Scores

Severity
low
CVSS v2
3.3
CVSS v3
3.8
CVSS v4
—
EPSS
—

Cisco ISE BYOD Session Hijacking 802.1X Network Security

← All CVEs

Related CVEs

low

CVE-2026-73442

On Arista EOS switches with VRRP enabled, the peer device’s VRRP authentication keys are written to the switch’s trace logs in cleartext. An authenticated user with sufficient privileges can read these logs and obtain the credentials without needing network access to the VRRP segment.

View analysis

low

CVE-2026-86071

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.

View analysis

low

CVE-2026-92359

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. Upgrading to version [email protected] is sufficient to fix this issue. The patch is identified as 9b143b9668fa52c2054ede9d34a45ac4b4401089. It is suggested to upgrade the affected component.

View analysis

low

CVE-2026-91708

A race condition in Chrome’s network stack (prior to 153.0.8010.47) lets a remote attacker who has already compromised the renderer process read cross‑origin data from a crafted HTML page. The flaw is limited to situations where the renderer is already under attacker control, but it can expose sensitive information across origins.

View analysis