Cisco has revealed a bulletin to warn about two vital, unauthenticated distant code execution (RCE) vulnerabilities affecting Cisco Id Companies Engine (ISE) and the Passive Id Connector (ISE-PIC).
The failings, tracked beneath CVE-2025-20281 and CVE-2025-20282are rated with max severity (CVSS rating: 10.0). The primary impacts ISE and ISE-PIC variations 3.4 and three.3, whereas the second impacts solely model 3.4.
The basis reason for CVE-2025-20281 is an inadequate validation of user-supplied enter in a particular uncovered API. This enables an unauthenticated, distant attacker to ship a specifically crafted API request to execute arbitrary working system instructions as the foundation person.
The second challenge, CVE-2025-20282, is brought on by poor file validation in an inside API, permitting recordsdata to be written to privileged directories. The flaw permits unauthenticated, distant attackers to add arbitrary recordsdata to the goal system and execute them with root privileges.
Cisco Id Companies Engine (ISE) is a community safety coverage administration and entry management platform utilized by organizations to handle their community connections, serving as a community entry management (NAC), identification administration, and coverage enforcement device.
The product is usually utilized by giant enterprises, authorities organizations, universities, and repair suppliers, sitting on the core of the enterprise community.
The 2 flaws impacting it might allow full compromise and full distant takeover of the goal gadget with none authentication or person interplay.
Cisco famous within the bulletin that it’s not conscious of any instances of energetic exploitation for the 2 flaws, however putting in the brand new updates must be prioritized.
Customers are advisable to improve to three.3 Patch 6 (ise-apply-CSCwo99449_3.3.0.430_patch4) and three.4 Patch 2 (ise-apply-CSCwo99449_3.4.0.608_patch1) or later. No workarounds have been supplied to mitigate the issues, so making use of the safety updates is the advisable answer.
Cisco additionally revealed a separate bulletin relating to a medium-severity authentication bypass flaw, tracked as CVE-2025-20264which additionally impacts ISE.
The flaw is brought on by the insufficient enforcement of authorization for customers created by way of SAML SSO integration with an exterior identification supplier. An attacker with legitimate SSO-authenticated credentials can ship a particular sequence of instructions to change system settings or carry out a system restart.
CVE-2025-20264 impacts all variations of ISE as much as the three.4 department. Fixes have been made out there in 3.4 Patch 2 and three.3 Patch 5. The seller promised to repair the flaw for 3.2 with the discharge of three.2 Patch 8, deliberate for November 2025.
ISE 3.1 and earlier are additionally impacted however are not supported, and customers are advisable emigrate to a more recent launch department.
Patching used to imply advanced scripts, lengthy hours, and infinite hearth drills. Not anymore.
On this new information, Tines breaks down how trendy IT orgs are leveling up with automation. Patch quicker, scale back overhead, and concentrate on strategic work — no advanced scripts required.
