Loading story…
Cisco disclosed multiple vulnerabilities in Identity Services Engine (ISE) and ISE-PIC that could let attackers compromise deployments through authentication bypass, unauthenticated remote code execution, and path traversal. One of the issues, tracked as CVE-2025-20281, was described in public research as allowing unauthenticated attackers to achieve remote code execution as root because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure.
Separate Cisco advisories also detailed additional authentication bypass weaknesses and a combination of remote code execution and path traversal flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for CVE-2025-20281 increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco issued a security advisory covering authentication bypass vulnerabilities affecting Cisco Identity Services Engine. The advisory publicly documented the issue and associated remediation guidance.
Cisco released a security advisory for Cisco Identity Services Engine covering remote code execution and path traversal vulnerabilities. The advisory formally disclosed the flaws and provided vendor guidance for affected deployments.
A GitHub repository by grupooruss published a script to check Cisco Identity Services Engine (ISE) and ISE-PIC instances for CVE-2025-20281, described as an unauthenticated remote code execution vulnerability allowing root-level compromise due to insufficient input validation in an API.
Cisco issued a security advisory for Cisco Identity Services Engine covering unauthenticated remote code execution vulnerabilities. The advisory publicly disclosed the flaws and provided vendor guidance for affected deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
sec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourcegithub.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed two high-severity vulnerabilities in **Cisco Identity Services Engine (ISE)**, tracked as `CVE-2026-20180` and `CVE-2026-20186`, that allow an authenticated attacker to execute arbitrary commands on the underlying operating system by sending crafted HTTP requests. Both issues require at least **Read Only Admin** credentials and stem from insufficient validation of user-supplied input; Cisco mapped the flaws to **`CWE-22`** and **`CWE-77`** respectively. Cisco assigned both vulnerabilities the same **CVSS v3.1** score vector: `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. Successful exploitation can provide user-level operating system access and may allow attackers to escalate privileges to **root**. Cisco warned that in **single-node ISE deployments**, exploitation could also make the affected node unavailable, creating a denial-of-service condition that prevents unauthenticated endpoints from accessing the network until the system is restored.
Jun 29, 2026
Cisco disclosed two vulnerabilities in **Cisco Identity Services Engine (ISE)** and **Cisco ISE Passive Identity Connector (ISE-PIC)**, including the critical remote code execution flaw `CVE-2026-20181` and the high-severity information disclosure flaw `CVE-2026-20190`. Cisco said `CVE-2026-20181` carries a CVSS score of **9.1** and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated **7.5**, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks. The affected software includes all releases prior to **3.3**, versions before **3.3 Patch 11** in release 3.3, versions before **3.4 Patch 6** in release 3.4, and versions before **3.5 Patch 4** in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Jun 29, 2026
Cisco disclosed two critical vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that allow unauthenticated remote attackers to execute arbitrary code on the underlying operating system with **root privileges**. The flaws, tracked as `CVE-2025-20281` and `CVE-2025-20282`, are independent issues, meaning exploitation of one is not required to exploit the other. `CVE-2025-20281` affects Cisco ISE and ISE-PIC **version 3.3 and later**, while `CVE-2025-20282` affects **version 3.4 only**; Cisco said **version 3.2 and earlier are not affected**. Cisco also warned that `CVE-2025-20282` can enable arbitrary file upload and execution on vulnerable devices. Patches have been released, and organizations running affected deployments have been urged to update immediately.
Jun 29, 2026