CVE-2025-20281
published 2025-06-25CVE-2025-20281: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2025-08-18
Exploited in the wild
EPSS
96.73%
99.9th percentile
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine_passive_identity_connector | — | — |
| cisco | identity_services_engine_passive_identity_connector | — | — |
| cisco | identity_services_engine_unauthenticated | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlPOST /deployment-rpc/enableStrongSwanTunnel HTTP/1.1
path/deployment-rpc/enableStrongSwanTunnel
cookieAPPSESSIONID=
bytes
aced0005757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b47020000787000000002
- →Detect exploitation attempts by monitoring for unauthenticated POST requests to the /deployment-rpc/enableStrongSwanTunnel API endpoint on Cisco ISE devices.
- →Look for Java serialized object payloads (magic bytes aced0005) in HTTP request bodies to the ISE API, specifically targeting the enableStrongSwanTunnel() method.
- →Detect command injection attempts using ${IFS} as a whitespace bypass in payloads sent to the Cisco ISE API, indicative of exploitation of CVE-2025-20281.
- →The exploit achieves arbitrary command execution as root inside a Docker container by exploiting the behavior of Java's Runtime.exec() and using ${IFS} to bypass argument tokenization issues. ↗
- →Monitor for Linux container escape activity using cgroups and release_agent following initial exploitation of Cisco ISE, as the full exploit chain includes a Docker container escape to gain host root. ↗
- →Use the Shodan dork 'Set-Cookie: APPSESSIONID=' 'Path=/admin' to identify exposed Cisco ISE instances that may be targeted.
- →Verify response fingerprint for exploitation: HTTP 200 status code with a body length of exactly 2 bytes from the enableStrongSwanTunnel endpoint.
- →The root cause is unsafe deserialization and command injection in the enableStrongSwanTunnel() method; monitor for serialized Java String[] array payloads (type descriptor [Ljava.lang.String;) in API requests. ↗
- ·CVE-2025-20281 only affects Cisco ISE and ISE-PIC versions 3.3 and 3.4; ISE 3.2 and earlier are NOT affected and do not require patching. ↗
- ·Hot patches ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz and ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz did NOT address CVE-2025-20337 and have been deferred; full remediation requires upgrading to ISE 3.3 Patch 7 or 3.4 Patch 2. ↗
- ·There are no workarounds available for CVE-2025-20281; patching is the only remediation option. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_cisco10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rc4f-42xm-hvjw: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the unde
ghsa_unreviewed·2025-06-26
CVE-2025-20281 [CRITICAL] CWE-74 GHSA-rc4f-42xm-hvjw: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the unde
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
VulnCheck
Cisco Identity Services Engine Injection Vulnerability
vulncheck·2025·CVSS 10.0
CVE-2025-20281 [CRITICAL] CWE-74 Cisco Identity Services Engine Injection Vulnerability
Cisco Identity Services Engine Injection Vulnerability
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
Affected: Cisco Identity Services Engine
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-13&host_type=s
CISA
Cisco Identity Services Engine Injection Vulnerability
cisa·2025-07-28·CVSS 10.0
CVE-2025-20281 [CRITICAL] CWE-74 Cisco Identity Services Engine Injection Vulnerability
Vulnerability: Cisco Identity Services Engine Injection Vulnerability
Affected: Cisco Identity Services Engine
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZA
Cisco
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
vendor_cisco·2025-06-25·CVSS 10.0
CVE-2025-20281 [CRITICAL] CWE-269 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Note: Since the publication of version 1.0 of this advisory, improved fixed releases have become available. Cisco recommends upgrading to an enhanced fixed release as follows:
If Cisco ISE is running Release 3.4 Patch 2, no further action is necessary.
Cisco
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2025-20281 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
CVE-2025-20281: Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-269, CWE-74, CWE-269, CWE-74
Bug IDs: CSCwo99449, CSCwp02814, CSCwp02821, CSCwo99449, CSCwo99449
Suricata
ET WEB_SPECIFIC_APPS Cisco ISE ERS API Unauthenticated RCE (CVE-2025-20281)
suricata·2025-07-17·CVSS 10.0
CVE-2025-20281 [CRITICAL] ET WEB_SPECIFIC_APPS Cisco ISE ERS API Unauthenticated RCE (CVE-2025-20281)
ET WEB_SPECIFIC_APPS Cisco ISE ERS API Unauthenticated RCE (CVE-2025-20281)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco ISE ERS API Unauthenticated RCE (CVE-2025-20281)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/deployment-rpc/enableStrongSwanTunnel"; fast_pattern; startswith; http.request_body; content:"java.lang.String"; pcre:"/^.*?[\x3b\x7c\x60\x24]/R"; reference:url,www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability; reference:cve,2025-20281; classtype:web-application-attack; sid:2063545; rev:2; metadata:affected_product Cisco_ISE, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_17, cve CVE_2025_20281, deployment Perimeter, deployment
Nuclei
Cisco ISE - Remote Code Execution
nuclei·CVSS 10.0
CVE-2025-20281 [CRITICAL] Cisco ISE - Remote Code Execution
Cisco ISE - Remote Code Execution
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Template:
id: CVE-2025-20281
info:
name: Cisco ISE - Remote Code Execution
author: daffainfo
severity: critical
description: |
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to
Fortinet
The Resurgence of IoT Malware: Inside the Mirai-Based Botnet Campaign | FortiGuard Labs
blogs_fortinet·2025-08-22
The Resurgence of IoT Malware: Inside the Mirai-Based Botnet Campaign | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
The Resurgence of IoT Malware: Inside the Mirai-Based Botnet Campaign
Unpacking the Mirai-based Gayfemboy botnet campaign, its evolution, global targets, and Fortinet security protections
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Incidents
Malware Analysis
Conclusion
Fortinet Protections
IOCs
By Vincent Li | August 22, 2025
Affected Platforms: DrayTek Vigor2960 1.3.1_Beta, DrayTek Vigor3900 1.4.4_Beta, DrayTek Vigor300B 1.3.3_Beta, DrayTek Vigor300B 1.4.2.1_Beta, DrayTek Vigor300B 1.4.4_Beta, TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219, Raisecom MSG1200, Raisecom MSG2100E, Raisecom MSG2200, Raisecom MSG2300 3.90, Cisco ISE, Cisco ISE-PIC
Impacted Users: Any organization
Impact: Remote attackers gain control
Bleepingcomputer
Exploit available for critical Cisco ISE bug exploited in attacks
blogs_bleepingcomputer·2025-07-28·CVSS 10.0
CVE-2025-20281 [CRITICAL] Exploit available for critical Cisco ISE bug exploited in attacks
## Exploit available for critical Cisco ISE bug exploited in attacks
## Bill Toulas
Security researcher Bobby Gould has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, an unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE).
The critical vulnerability was first disclosed on June 25, 2025 , with Cisco warning that it impacts ISE and ISE-PIC versions 3.3 and 3.4, allowing unauthenticated, remote attackers to upload arbitrary files to the target system and execute them with root privileges.
The issue stems from unsafe deserialization and command injection in the enableStrongSwanTunnel() method.
Three weeks later, the vendor added one more flaw to the same bulletin, CVE-2025-20337 , which relates to the same flaw but
Checkpoint
28th July – Threat Intelligence Report
blogs_checkpoint·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] 28th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The US Energy Department, including its National Nuclear Security Administration (NNSA), was reportedly breached as part of a Microsoft SharePoint vulnerability exploit. The breach was linked to a broader espionage campaign, that targeted government agencies via the CVE-2025-53770 The extent of the intrusion and data compromise
Bleepingcomputer
Cisco: Maximum-severity ISE RCE flaws now exploited in attacks
blogs_bleepingcomputer·2025-07-22·CVSS 10.0
[CRITICAL] Cisco: Maximum-severity ISE RCE flaws now exploited in attacks
## Cisco: Maximum-severity ISE RCE flaws now exploited in attacks
## Bill Toulas
Cisco is warning that three recently patched critical remote code execution vulnerabilities in Cisco Identity Services Engine (ISE) are now being actively exploited in attacks.
Although the vendor did not specify how they were being exploited and whether they were successful, applying the security updates as soon as possible is now critical.
“In July 2025, the Cisco PSIRT became aware of attempted exploitation of some of these vulnerabilities in the wild,” reads the updated advisory .
“Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities.”
Cisco Identity Services Engine (ISE) is a platform that enables large organizations to control n
Bleepingcomputer
Max severity Cisco ISE bug allows pre-auth command execution, patch now
blogs_bleepingcomputer·2025-07-17·CVSS 10.0
CVE-2025-20337 [CRITICAL] Max severity Cisco ISE bug allows pre-auth command execution, patch now
## Max severity Cisco ISE bug allows pre-auth command execution, patch now
## Bill Toulas
A critical vulnerability (CVE-2025-20337) in Cisco's Identity Services Engine (ISE) could be exploited to let an unauthenticated attacker store malicious files, execute arbitrary code, or gain root privileges on vulnerable devices.
The security issue received the maximum severity rating, 10 out of 10, and is caused by insufficient user-supplied input validation checks.
It was discovered by Kentaro Kawane, a researcher at the Japanese cybersecurity service GMO Cybersecurity by Ierae, and reported Trend Micro's Zero Day Initiative (ZDI).
A remote unauthenticated attacker could leverage it by submitting a specially crafted API request
The vulnerability was added via an update to the security bullet
Checkpoint
30th June – Threat Intelligence Report
blogs_checkpoint·2025-06-30
CVE-2025-20281 30th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 30th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 29th June, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Grocery giant Ahold Delhaize has disclosed a data breach that resulted in the theft of personal, financial, employment, and health information belonging to over 2.2 million individuals from its American business systems. The leaked data includes names, contact details, IDs, bank account numbers, and medical information . While
Bleepingcomputer
Cisco warns of max severity RCE flaws in Identity Services Engine
blogs_bleepingcomputer·2025-06-26·CVSS 10.0
CVE-2025-20281 [CRITICAL] Cisco warns of max severity RCE flaws in Identity Services Engine
## Cisco warns of max severity RCE flaws in Identity Services Engine
## Bill Toulas
Cisco has published a bulletin to warn about two critical, unauthenticated remote code execution (RCE) vulnerabilities affecting Cisco Identity Services Engine (ISE) and the Passive Identity Connector (ISE-PIC).
The flaws, tracked under CVE-2025-20281 and CVE-2025-20282 , are rated with max severity (CVSS score: 10.0). The first impacts ISE and ISE-PIC versions 3.4 and 3.3, while the second affects only version 3.4.
The root cause of CVE-2025-20281 is an insufficient validation of user-supplied input in a specific exposed API. This allows an unauthenticated, remote attacker to send a specially crafted API request to execute arbitrary operating system commands as the root user.
The second issue, CVE-202
Greynoiseio
NoiseLetter July 2025
blogs_greynoiseio
NoiseLetter July 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability
2025-06-25
Published
2025-07-28
Added to CISA KEV
Exploited in the wild