Cisco has printed a bulletin to warn about two crucial, unauthenticated distant code execution (RCE) vulnerabilities affecting Cisco Id Companies Engine (ISE) and the Passive Id Connector (ISE-PIC).
The failings, tracked underneath CVE-2025-20281 and CVE-2025-20282, are rated with max severity (CVSS rating: 10.0). The primary impacts ISE and ISE-PIC variations 3.4 and three.3, whereas the second impacts solely model 3.4.
The basis explanation for CVE-2025-20281 is an inadequate validation of user-supplied enter in a particular uncovered API. This enables an unauthenticated, distant attacker to ship a specifically crafted API request to execute arbitrary working system instructions as the foundation consumer.
The second subject, CVE-2025-20282, is brought on by poor file validation in an inside API, permitting information to be written to privileged directories. The flaw permits unauthenticated, distant attackers to add arbitrary information to the goal system and execute them with root privileges.
Cisco Id Companies Engine (ISE) is a community safety coverage administration and entry management platform utilized by organizations to handle their community connections, serving as a community entry management (NAC), id administration, and coverage enforcement software.
The product is often utilized by massive enterprises, authorities organizations, universities, and repair suppliers, sitting on the core of the enterprise community.
The 2 flaws impacting it might allow full compromise and full distant takeover of the goal machine with none authentication or consumer interplay.
Cisco famous within the bulletin that it’s not conscious of any instances of lively exploitation for the 2 flaws, however putting in the brand new updates needs to be prioritized.
Customers are really useful to improve to three.3 Patch 6 (ise-apply-CSCwo99449_3.3.0.430_patch4) and three.4 Patch 2 (ise-apply-CSCwo99449_3.4.0.608_patch1) or later. No workarounds have been supplied to mitigate the failings, so making use of the safety updates is the really useful resolution.
Cisco additionally printed a separate bulletin concerning a medium-severity authentication bypass flaw, tracked as CVE-2025-20264, which additionally impacts ISE.
The flaw is brought on by the insufficient enforcement of authorization for customers created by way of SAML SSO integration with an exterior id supplier. An attacker with legitimate SSO-authenticated credentials can ship a particular sequence of instructions to switch system settings or carry out a system restart.
CVE-2025-20264 impacts all variations of ISE as much as the three.4 department. Fixes have been made out there in 3.4 Patch 2 and three.3 Patch 5. The seller promised to repair the flaw for 3.2 with the discharge of three.2 Patch 8, deliberate for November 2025.
ISE 3.1 and earlier are additionally impacted however are now not supported, and customers are really useful emigrate to a more moderen launch department.
Patching used to imply complicated scripts, lengthy hours, and limitless hearth drills. Not anymore.
On this new information, Tines breaks down how trendy IT orgs are leveling up with automation. Patch quicker, cut back overhead, and deal with strategic work — no complicated scripts required.
