A remote attacker who is not authenticated can send a specially crafted request to Cisco Identity Services Engine (ISE) or the ISE Passive Identity Connector (ISE‑PIC). Because the software performs insufficient authorization checks, the request is granted an endpoint certificate. The attacker can then use certificate to impersonate an authorized device, potentially gaining network access or escalating privileges. The flaw is therefore an authorization bypass that can be exploited without any initial authentication.

The flaw exists in Cisco ISE Passive Identity Connector and Cisco Identity Services Engine software. No specific version range is provided, so all deployments of these products are potentially vulnerable until a patch is applied.

The CVSS score of 5.3 indicates a moderate impact. EPSS data is unavailable and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited or no known exploitation in the wild. The likely attack vector is remote over the network, as the attacker need only send a request to the affected service. Because the flaw allows certificate issuance, an attacker can obtain credentials that may be reused to attack other components of the network. Although no public exploit has been disclosed, the ability to impersonate an endpoint warrants prompt remediation.