Cisco has revealed a bulletin to warn about two crucial, unauthenticated distant code execution (RCE) vulnerabilities affecting Cisco Id Providers Engine (ISE) and the Passive Id Connector (ISE-PIC).
The failings, tracked underneath CVE-2025-20281 and CVE-2025-20282, are rated with max severity (CVSS rating: 10.0). The primary impacts ISE and ISE-PIC variations 3.4 and three.3, whereas the second impacts solely model 3.4.
The foundation explanation for CVE-2025-20281 is an inadequate validation of user-supplied enter in a particular uncovered API. This permits an unauthenticated, distant attacker to ship a specifically crafted API request to execute arbitrary working system instructions as the foundation consumer.
The second challenge, CVE-2025-20282, is attributable to poor file validation in an inner API, permitting recordsdata to be written to privileged directories. The flaw permits unauthenticated, distant attackers to add arbitrary recordsdata to the goal system and execute them with root privileges.
Cisco Id Providers Engine (ISE) is a community security coverage administration and entry management platform utilized by organizations to handle their community connections, serving as a community entry management (NAC), id administration, and coverage enforcement device.
The product is often utilized by giant enterprises, authorities organizations, universities, and repair suppliers, sitting on the core of the enterprise community.
The 2 flaws impacting it might allow full compromise and full distant takeover of the goal system with none authentication or consumer interplay.
Cisco famous within the bulletin that it’s not conscious of any circumstances of energetic exploitation for the 2 flaws, however putting in the brand new updates needs to be prioritized.
Customers are beneficial to improve to three.3 Patch 6 (ise-apply-CSCwo99449_3.3.0.430_patch4) and three.4 Patch 2 (ise-apply-CSCwo99449_3.4.0.608_patch1) or later. No workarounds had been offered to mitigate the issues, so making use of the security updates is the beneficial resolution.
Cisco additionally revealed a separate bulletin concerning a medium-severity authentication bypass flaw, tracked as CVE-2025-20264, which additionally impacts ISE.
The flaw is attributable to the insufficient enforcement of authorization for customers created by way of SAML SSO integration with an exterior id supplier. An attacker with legitimate SSO-authenticated credentials can ship a particular sequence of instructions to switch system settings or carry out a system restart.
CVE-2025-20264 impacts all variations of ISE as much as the three.4 department. Fixes had been made obtainable in 3.4 Patch 2 and three.3 Patch 5. The seller promised to repair the flaw for 3.2 with the discharge of three.2 Patch 8, deliberate for November 2025.
ISE 3.1 and earlier are additionally impacted however are now not supported, and customers are beneficial emigrate to a more recent launch department.
Patching used to imply advanced scripts, lengthy hours, and infinite hearth drills. Not anymore.
On this new information, Tines breaks down how fashionable IT orgs are leveling up with automation. Patch sooner, cut back overhead, and give attention to strategic work — no advanced scripts required.
