Cisco ISE CVE-2026-20071

Exploitation requires that Cisco ISE be deployed with the SSID bring-your-own-device (BYOD) onboarding workflow in use - a specific, optional NAC feature, not a default of every ISE install. The attacker must be adjacent (AV:A: on the same local/Layer-2 network segment, e.g., the guest or onboarding SSID) and must catch a legitimate user in the act of onboarding, since the attack hinges on spoofing that user and triggering a redirection to the guest web portal (UI:R - a real user's onboarding session must be in flight). No authentication is required (PR:N). Limiting factors: adjacency (no remote Internet exploitation), dependence on a concurrent legitimate onboarding session, and reliance on the BYOD onboarding feature being configured - all of which substantially narrow real-world exploitability beyond the raw vector.

This is a genuinely low-priority issue by every available signal, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score is 3.8 (Low), driven by AV:A (adjacent - the attacker must be on the same Layer-2/local network segment as the victim's onboarding session, not remote-Internet-reachable), UI:R (the attack depends on a legitimate user actually undergoing BYOD onboarding and being redirected to the guest portal), and a deliberately narrow impact of C:N/I:L/A:N (integrity-only, no data disclosure, no availability loss). The S:C scope change reflects that a successful hijack yields access to a protected 802.1X network beyond the ISE authorization boundary, but the direct technical impact scored by Cisco remains modest. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict among the signals - a low CVSS with adjacency + required user interaction + no exploitation evidence all point the same direction. The one nuance worth stating: because a successful exploit grants entry to an otherwise protected enterprise 802.1X network, the real-world consequence (a foothold on a trusted network) can exceed what the I:L score suggests, so defenders should weight the scope change more heavily than the raw 3.8 implies. This is patch-in-normal-cycle, not emergency.

An attacker positioned on the same local/adjacent network (e.g., an open or guest wireless segment) waits for or induces a legitimate user to begin Cisco ISE BYOD onboarding, then spoofs that user and triggers a redirection to the guest web portal to seize the in-flight onboarding session. Because authentication checks during onboarding are insufficient, the attacker takes over the session and gains access to the protected 802.1X network. No public exploit code is identified at time of analysis, and success depends on the victim actively onboarding (UI:R) and on attacker adjacency (AV:A).