CVE-2025-20281

What it actually does

This is a critical unauthenticated remote code execution vulnerability in a Cisco Identity Services Engine and Cisco ISE-PIC API. Because user-supplied input is not sufficiently validated, a remote attacker can send a crafted API request that causes command or code execution on the underlying operating system with root privileges. Successful exploitation gives the attacker full control of the affected appliance, including the ability to alter identity policy, access configuration and secrets, create persistence, pivot to connected systems, and tamper with logs.

Why it matters to the business

Compromise of Cisco ISE or ISE-PIC can directly affect enterprise network access control, identity-based segmentation, device authentication, and policy enforcement. An attacker with root access to ISE may be able to disrupt user and device onboarding, weaken or bypass access policies, harvest credentials or integration secrets, and use the appliance as a trusted foothold into the internal network. The CVSS score is 10.0, EPSS is very high at 0.97069, exploitation is reported as active in the wild, and the issue is in the CISA Known Exploited Vulnerabilities catalog with a remediation due date of 2025-08-18, making this an urgent operational risk even where ransomware use has not been specifically reported.

How an attack unfolds

An attacker first identifies an internet-exposed or network-reachable Cisco ISE or ISE-PIC management/API interface. No valid account is required. The attacker sends a specially crafted request to the vulnerable API that abuses insufficient input validation. If the appliance is vulnerable, the request is processed in a way that executes attacker-controlled code or commands as root on the underlying operating system. After gaining code execution, the attacker may deploy a web shell or other persistence mechanism, run reconnaissance commands, collect configuration and secrets, modify identity or network access policies, create additional accounts, disable or tamper with logging, and pivot from the trusted ISE appliance toward directory, VPN, network infrastructure, or endpoint management systems. Public reporting identifies this as actively exploited in the wild under the Cisco Identity Services Engine injection vulnerability activity cluster.

How to fix it

Apply the Cisco fixed software release for the affected Cisco ISE or Cisco ISE-PIC version as directed in the official Cisco security advisory. Because no fixed version list was provided in the input, administrators should verify the exact appliance release and upgrade path against Cisco’s advisory and release notes rather than relying on generic version assumptions. Prioritize emergency patching for any internet-facing, partner-facing, or broadly reachable management/API interfaces. If immediate patching is not possible, restrict access to Cisco ISE and ISE-PIC administrative and API interfaces to dedicated management networks, VPNs, and trusted administrator hosts; block direct internet exposure; enforce network ACLs and firewall rules; disable unused APIs or services where Cisco guidance permits; and increase monitoring until the appliance is upgraded. After remediation, rotate credentials, API keys, certificates, and integration secrets that may have been accessible from the appliance if compromise is suspected.

How to confirm the fix worked

Confirm the installed Cisco ISE or Cisco ISE-PIC version is one of the vendor-fixed releases listed in the Cisco advisory for this vulnerability. Verify that management and API interfaces are not directly reachable from untrusted networks and are limited by firewall or ACL policy. Use authenticated administrative checks, appliance inventory, or Cisco-supported CLI/UI version checks to validate the running release after upgrade. Where vulnerability scanners are used, run a credentialed or vendor-aware check for CVE-2025-20281 and confirm the finding is closed. Perform a controlled test of network exposure by scanning from untrusted network segments to ensure only intended management sources can reach ISE administrative/API ports. Review post-upgrade health, policy synchronization, node replication, and authentication flows to ensure remediation did not disrupt access-control operations.

Typical attack path

1. Discover Cisco ISE or Cisco ISE-PIC instances through internet scanning, certificate metadata, exposed management portals, or internal reconnaissance.
2. Confirm the target is running an affected software release and has the vulnerable API reachable.
3. Send a crafted unauthenticated API request containing malicious input designed to trigger code execution.
4. Obtain command execution on the appliance as root.
5. Run system reconnaissance commands and enumerate network configuration, users, certificates, integrations, and stored secrets.
6. Establish persistence through dropped files, modified services, scheduled tasks, unauthorized accounts, or backdoor access paths.
7. Tamper with logs or application state to hide exploitation activity.
8. Use the compromised ISE appliance to alter access policies, harvest credentials or tokens, and pivot into adjacent enterprise infrastructure.

How to detect it

Investigate both application-layer API activity and host-level artifacts on Cisco ISE or ISE-PIC appliances. Review Cisco ISE administrative audit logs, application logs, API access logs, reverse proxy or load balancer logs, firewall logs, VPN logs, and any centralized syslog/SIEM telemetry for unauthenticated requests to ISE API endpoints followed by server errors, process launches, configuration changes, or new administrative activity. Look for requests containing command-injection metacharacters, encoded payloads, shell syntax, outbound download commands, or attempts to reach suspicious external infrastructure. On the appliance, examine system logs, shell history where available, unexpected files in temporary or web-accessible directories, modified startup scripts or services, unauthorized local or application users, unusual cron entries, unexplained root-owned files, and evidence of log truncation or deletion. Correlate any suspicious activity with outbound network connections from the ISE appliance to unfamiliar IPs or domains, especially shortly after malformed API requests. Because the vulnerable API name is not specified in the input, detection should use broad patterns across all ISE API and web logs rather than a single endpoint-only rule.

• CVE-2025-20281
• Cisco Identity Services Engine Injection Vulnerability
• ISE
• ISE-PIC
• /api/
• /ers/
• %3b
• %7c
• %26%26
• %60
• $(
• ;curl
• ;wget
• |curl
• |wget
• bash -c
• /bin/sh
• /bin/bash
• nc -e
• python -c
• perl -e
• chmod +x
• /tmp/
• /var/tmp/
• curl http
• wget http

What your security team should do

• Treat this as an emergency remediation item because it is unauthenticated root-level RCE, has a CVSS score of 10.0, has very high EPSS, and is listed in CISA KEV with a 2025-08-18 due date.
• Immediately inventory all Cisco ISE and Cisco ISE-PIC appliances, including primary, secondary, policy service, monitoring, and lab or disaster-recovery nodes.
• Patch or upgrade all affected nodes to Cisco-fixed releases following Cisco’s supported upgrade path.
• Remove direct internet exposure and restrict administrative/API access to hardened management networks and known administrator hosts.
• Search historical logs for suspicious unauthenticated API access, unusual errors, command execution artifacts, new files, unexpected processes, unauthorized accounts, and log tampering.
• If exploitation is suspected, isolate the appliance, preserve forensic evidence, collect Cisco support bundles and system logs, rotate secrets stored or used by ISE, and rebuild or reimage according to Cisco incident-response guidance.
• Review ISE policy changes, administrator accounts, certificates, external identity source integrations, pxGrid/API integrations, and network device credentials for unauthorized modification.
• Increase monitoring for authentication anomalies, unexpected policy changes, and lateral movement originating from ISE appliance IP addresses.
• Brief network, identity, and operations teams that ISE compromise can affect access-control enforcement and may require coordinated maintenance windows and credential rotation.