EUVD-2025-19167Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | CVSS 10.0 (Critical). KEV-listed — actively exploited. EPSS 30.4%. Public PoC available. No authentication required. Root-level code execution. ISE controls network access for the entire organization. Compromise = ability to grant/deny network access at will. |
| Exploit ScenarioDerived | An attacker sends crafted requests to the unauthenticated ISE API endpoint, injecting commands that execute as root. With root access to ISE, the attacker can: modify network access policies to grant their devices unrestricted access, disable 802.1X authentication allowing any device onto the network, access the ISE database containing user credentials and device inventories, modify RADIUS/TACACS configurations to intercept authentication, and use ISE's network position to pivot into critical infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Cisco ISE and ISE-PIC contain a critical input injection vulnerability (CVE-2025-20281, CVSS 10.0) that allows unauthenticated remote attackers to execute arbitrary code as root on the underlying operating system. With EPSS 30.4% and KEV listing, this vulnerability targets the network access control platform that governs who and what can access the enterprise network — compromising ISE means controlling network admission for the entire organization.
Earlier versions of this analysis (1)
Cisco ISE and ISE-PIC contain an injection vulnerability (CWE-74) in a specific API that allows unauthenticated remote attackers to execute arbitrary code as root due to insufficient input validation.
RemediationAI
Apply Cisco security update IMMEDIATELY — emergency priority. Restrict API access to trusted management networks. Monitor ISE policy changes for unauthorized modifications. Audit network access logs for suspicious device admissions. Review RADIUS/TACACS configurations for tampering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco ISE (Identity Services Engine) is the central NAC (Network Access Control) platform that authenticates users and devices, enforces access policies, and controls who can connect to the network. The vulnerability exists in an API endpoint that does not require authentication and fails to properly validate user input. Successful exploitation provides root-level code execution on the ISE appliance. Compromise of ISE gives attackers control over network access policies for the entire organization.
Know when Identity Services Engine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Executive ViewAI
A critical, actively exploited vulnerability in Cisco ISE and ISE-PIC allows unauthenticated attackers to gain root-level control of affected systems without requiring valid credentials. Organizations running these identity and access management platforms face immediate risk of complete system compromise, potentially enabling lateral movement throughout the network and unauthorized access to sensitive corporate resources.
Implement network segmentation to restrict API access to trusted networks only; deploy Web Application Firewall (WAF) rules to filter malicious API requests targeting the vulnerable endpoint; disable the specific vulnerable API if not operationally required; implement strict rate limiting and request validation on API endpoints; enforce IP whitelisting for ISE administrative access; enable comprehensive API request logging for forensic analysis and threat detection; consider deploying ISE behind a reverse proxy with additional security controls.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Identity Services Engine
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2025-20282 is a critical remote code execution vulnerability in Cisco ISE and ISE-PIC that allows unauthenticated at
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to
A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, rem
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain an insufficiently protected cr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, re
A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command inje
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated
GitHub PoC
Exploit-DB