Cisco Identity Services Engine on Cloud Platforms Static Credential Vulnerability

TL;DR 📌

• A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20286.

What happened 🕵️‍♂️

The credentials that exist in Cisco ISE that is deployed in the cloud are specific to each release and platform. For example:

All instances of Release 3.1 on AWS will have the same static credentials. Credentials that are valid for access to a Release 3.1 deployment would not be valid to access a Release 3.2 deployment on the same platform. Release 3.2 on AWS would not have the same credentials as Release 3.2 on Azure.

Affected products 🖥️

This vulnerability affects the following releases of Cisco ISE in the default configuration when it is deployed on AWS, Azure, and OCI platforms: Platform Cisco ISE Vulnerable Releases AWS 3.1, 3.2, 3.3, and 3.4 Azure 3.2, 3.3, and 3.4 OCI 3.2, 3.3, and 3.4 Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

For information about the fixed Cisco software releases, see the Fixed Software ["#fs"] section of this advisory.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability. However, there are mitigations:

Allow source IPs that use Cloud Security Groups: Allowing the source IP addresses of Customer Administrators that use security groups on cloud platforms restricts access exclusively to authorized administrators before traffic reaches the Cisco ISE instance, effectively blocking any potentially malicious connections. Allow source IPs at Cisco ISE: In the Cisco ISE UI, allow the source IP addresses of Customer Administrators.

For fresh installations, run the application reset-config ise to reset user passwords to a new value. Running the application reset-config ise command is required only on the Primary Administration persona node in the cloud. There is no need to reset secondary nodes. If the Primary Administration persona is on-premises, running the command is not required.

Warnings:

Running the application reset-config ise command will reset Cisco ISE to the factory configuration. For details, see the Cisco ISE Configuration Guide [“https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/cli_guide/b_ise_CLI_Reference_Guide_32/b_ise_CLIReferenceGuide_32_chapter_01.html#wp1727183819”]. If the configuration backup that is being restored was taken before the vulnerability fix was applied, the old credentials will also be restored. Cisco recommends taking a new configuration backup after installing the fix to prevent the old credentials from being restored. If an old backup has been restored, the hot fix must be removed and re-installed.

While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-ise-aws-static-cred-FPMjUcm7
• Initial release: 2025-06-04T16:00:00 UTC
• Last updated: 2025-06-05T17:26:25 UTC

For leadership 🧭

Executive summary. Any Cisco ISE cloud deployment with the Primary Administration node on AWS, Azure or OCI shares identical built-in credentials with every other instance of that release, giving unauthenticated attackers a route to sensitive data and administrative control. Given the 9.9 severity and the fact that a full fix still requires a hot fix rather than a standard release, this needs mitigation this week, not at the next scheduled patch cycle.

Why it matters:

• Every AWS instance of a given ISE release (3.1 through 3.4) shares the same static credentials, and the same is true separately for Azure and OCI on releases 3.2 through 3.4, so knowledge of one deployment’s credentials compromises all others on that platform and version.
• If the Primary Administration node runs in the cloud, the deployment is affected regardless of whether policy or PSN nodes are on-premises, meaning the exposure sits at the most privileged point in the ISE architecture.
• An unauthenticated remote attacker with these credentials can access sensitive data, run limited administrative operations, change system configuration, or disrupt service on the affected node.
• Restoring a configuration backup taken before the hot fix is applied silently reintroduces the old static credentials, so a routine disaster-recovery restore can undo the remediation.

Now / Next / Later:

• Now: Restrict access to the Cisco ISE Primary Administration node immediately by allowing only known Customer Administrator source IPs, using cloud security groups and the ISE UI’s own IP allow-list, on every AWS, Azure or OCI deployment.
• Next: Apply the ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz hot fix to all affected 3.1-3.4 cloud deployments, and for fresh installs run application reset-config ise on the Primary Administration node to force new credentials.
• Later: Take a fresh configuration backup only after the hot fix is installed, document that older backups must not be restored without reapplying the fix, and review cloud deployment templates so future ISE builds don’t rely on release-wide default credentials.