CVE-2004-1460: Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Nove...

Security readout for executives and security teams

This is a legacy Cisco Secure ACS authentication bypass. If ACS 3.2(3) or earlier is configured to use Novell Directory Services with anonymous bind, a remote attacker may access AAA-protected clients using a blank password. Evidence is limited to older vulnerability records and the Cisco advisory reference. Exposure is likely narrow: legacy Cisco Secure ACS deployments using Novell Directory Services authentication with anonymous bind enabled. Organizations without Cisco ACS, without NDS authentication, or on newer/unaffected versions are not shown as affected by the provided sources. Treat confirmed exposure as high priority because ACS controls access to protected systems. Urgency depends on whether legacy ACS and the specific NDS anonymous-bind configuration still exist. No active exploitation is evidenced in the provided bundle. Mitigation focus: Identify any Cisco Secure ACS 3.2(3) or earlier deployments.; Disable anonymous bind in NDS integrations where possible.; Review Cisco’s 2004 advisory for vendor-approved fixes or configuration guidance..

Prepared

Jun 30, 2026, 00:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.