Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities

TL;DR 📌

• Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to issue commands on the underlying operating system as the root user and allow IP access filters to be bypassed. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. For more…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20284, CVE-2025-20283, CVE-2025-20285.

What happened 🕵️‍♂️

The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.

Details about the vulnerabilities are as follows:

CVE-2025-20283 and CVE-2025-20284: Cisco ISE API Authenticated Remote Code Execution Vulnerabilities

Multiple vulnerabilities in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root.

These vulnerabilities are due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit these vulnerabilities by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit these vulnerabilities, the attacker must have valid high-privileged credentials.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Bug ID(s): CSCwp02806 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp02806”] and CSCwp02819 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp02819”] CVE ID: CVE-2025-20283 and CVE-2025-20284 Security Impact Rating (SIR): Medium CVSS Base Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2025-20285: Cisco ISE IP Access Restriction for Admin Access Bypass Vulnerability

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address.

This vulnerability is due to improper enforcement of access controls that are configured using the IP Access Restriction feature. An attacker could exploit this vulnerability by logging in to the API from an unauthorized source IP address. A successful exploit could allow the attacker to gain access to the targeted device from an IP address that should have been restricted. To exploit this vulnerability, the attacker must have valid administrative credentials.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwp02811 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp02811”] CVE ID: CVE-2025-20285 Security Impact Rating (SIR): Medium CVSS Base Score: 4.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Affected products 🖥️

CVE-2025-20283 and CVE-2025-20284: At the time of publication, these vulnerabilities affected Cisco ISE and Cisco ISE-PIC, regardless of device configuration.

CVE-2025-20285: At the time of publication, this vulnerability affected Cisco ISE and Cisco ISE-PIC if the IP Access Restriction feature was enabled.

Note: The IP Access Restriction feature allows administrators to control which IP address or range of IP addresses can access the Cisco ISE admin portal and services. For more details, see Configure IP Access Restriction in ISE [“https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/222103-configure-ip-access-restriction-in-ise.html”].

For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address these vulnerabilities.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-ise-multi-3VpsXOxO
• Initial release: 2025-07-16T16:00:00 UTC
• Last updated: 2025-07-16T16:00:00 UTC

For leadership 🧭

Executive summary. An authenticated attacker with high-privileged credentials on Cisco ISE or ISE-PIC could gain root-level command execution or log into the admin portal from an IP address that was supposed to be blocked. Patches are available now for 3.3 and 3.4; since there are no workarounds, upgrading during the next change window is the only real fix.

Why it matters:

• The API remote code execution flaws (CVE-2025-20283, CVE-2025-20284) let a high-privileged authenticated user run arbitrary commands as root on the underlying operating system, regardless of how the device is configured.
• The IP Access Restriction bypass (CVE-2025-20285) undermines a control specifically used to lock the ISE admin portal down to trusted management IP ranges, letting an administrator-level attacker log in from elsewhere.
• ISE and ISE-PIC sit at the centre of network access control and identity decisions, so root compromise or admin access from an unexpected location has knock-on effects for every device relying on it for authentication and policy.
• There are no workarounds for any of the three issues, so exposure persists until the affected instance is patched to 3.3 Patch 7 or 3.4 Patch 2.

Now / Next / Later:

• Now: Identify every Cisco ISE and ISE-PIC instance running 3.3 or 3.4, and confirm which accounts hold high-privileged or administrative credentials capable of reaching the affected API or admin portal.
• Next: Schedule an upgrade to 3.3 Patch 7 or 3.4 Patch 2 (or later) for all affected instances during the next maintenance window, since no interim workaround exists.
• Later: Review and tighten who is granted high-privileged or administrative credentials on ISE, and periodically re-verify that IP Access Restriction configurations are enforced as intended after each upgrade.