BugZero | Cisco BugID CSCwf40128 - Accept client certificate without KU purpose valid...

BugZero | Cisco BugID CSCwf40128 - Accept client certificate without KU purpose valid...

Cisco - Defect ID: CSCwf40128

Accept client certificate without KU purpose validation per CiscoSSL rules

Cisco - Defect ID: CSCwf40128

Accept client certificate without KU purpose validation per CiscoSSL rules

Last updated on February 18th, 2026

BugZero Risk Score
9.5 High

Overall: 9.5

Severity: 10.0

Lifecycle: 9.1

Popularity: 5.1

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Bug Details

Description

Symptom

EAP-TLS flow fails to authenticate via ISE

Conditions

EAP-TLS flow (Client cert / EKU)

Workaround

NA

Further Problem Description

Change history

2024-10-24 Added: 003.001(000.518)

Links

Original Vendor Announcement

Relevant Products

Click on a version to see all relevant bugs

Affected versions:003.001(000.518)

Fixed versions: 003.003(000.430), 003.004(000.608), 3.1.0.518-Patch8, 3.2.0.542-Patch3

Relevant Products

Click on a version to see all relevant bugs

Affected versions:003.001(000.518)

Fixed versions: 003.003(000.430), 003.004(000.608), 3.1.0.518-Patch8, 3.2.0.542-Patch3

Top Cisco Defects

9.7Defect ID: CSCwt50498
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
9.7Defect ID: CSCwe44571
FMC: GEOLOCATION size is causing upgrade failures
9.7Defect ID: CSCvp16482
ASA reloads when establishing simultaneous ASDM sessions
9.7Defect ID: CSCvf84211
WLC dataplane reloads unexpectedly due to core 0 hung and RML interrupt handling
9.7Defect ID: CSCvf76274
Cisco APs can no longer join the WLC; CAPWAP-3-DTLS_DB_ERR

Ready to prevent the next vendor outage?