Cisco ISE vulnerabilities actively exploited
Take action: If you still haven't patched your Cisco Identity Services Engine (ISE), DO IT NOW! Your Cisco ISE is being actively attacked. So don't wait.
Learn More
Cisco is reporting that three maximum-severity remote code execution vulnerabilities affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) are now being actively exploited by threat actors.
Cisco Identity Services Engine is a network access control and policy enforcement platform used by organizations worldwide to manage device authentication, authorization, and compliance monitoring. A successful compromise of these systems could provide attackers with visibility into network traffic, the ability to modify security policies, and potential access to sensitive organizational data flowing through the network infrastructure.
The exploited vulnerabilities are:
- CVE-2025-20281 - An unauthenticated remote code execution vulnerability in specific APIs of Cisco ISE and ISE-PIC that allows attackers to execute arbitrary operating system commands as root through insufficient validation of user-supplied input.
- CVE-2025-20282 - An unauthenticated remote code execution vulnerability in internal APIs that enables attackers to upload arbitrary files to privileged directories and execute them with root privileges due to inadequate file validation checks.
- CVE-2025-20337 - An unauthenticated remote code execution vulnerability caused bt insufficient input validation in ISE APIs, allowing unauthenticated remote attackers to obtain root privileges through crafted API requests.
Organizations should apply latest patches to ISE immediately.
Update - As of 28th of July 2028, security researcher Bobby Gould published a PoC exploit chain for CVE-2025-20281 and CVE-2025-20337.
