Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities

TL;DR 📌

Multiple stored cross-site scripting (XSS) vulnerabilities have been identified in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). These vulnerabilities could allow authenticated attackers to modify configurations or execute malicious scripts. Software updates are available to address these issues, but no workarounds exist.

What happened 🕵️‍♂️

Cisco has disclosed multiple vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). These vulnerabilities could allow an authenticated, remote attacker to conduct stored XSS attacks or modify device configurations. The vulnerabilities stem from insufficient validation of user input and lack of server-side validation of administrator permissions.

Affected products 🖥️

• Cisco Identity Services Engine (ISE) Software
• Cisco ISE Passive Identity Connector (ISE-PIC) Software (affected by CVE-2025-20331 only)

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds available to mitigate these vulnerabilities.

Risk in context 🎯

The highest CVSS score for these vulnerabilities is 5.4, categorizing them as Medium severity. Exploitation requires authenticated access, which limits exposure but still poses a risk to sensitive information and device integrity.

Fast facts ⚡

• Vulnerabilities: CVE-2025-20331 (Stored XSS), CVE-2025-20332 (Authorization Bypass)
• Highest CVSS Score: 5.4 (Medium Severity)
• No workarounds available
• Software updates are necessary to mitigate risks

For leadership 🧭

Executive summary. Two flaws in Cisco Identity Services Engine and ISE-PIC let an already-logged-in user plant scripts that run in other admins’ sessions or change device settings they shouldn’t be able to touch. There is no workaround, so the fix needs scheduling into a change window rather than urgent out-of-hours action.

Why it matters:

• CVE-2025-20331 allows a stored XSS payload to be saved in ISE and executed against other authenticated users, potentially hijacking an admin session on your identity policy engine.
• CVE-2025-20332 stems from missing server-side checks on administrator permissions, so an authenticated user could modify configurations beyond their assigned role.
• ISE-PIC is affected by CVE-2025-20331 only, so passive identity deployments carry the XSS risk but not the authorization bypass.
• No interim mitigation exists, meaning exposure continues on unpatched systems until the software is upgraded.

Now / Next / Later:

• Now: Identify all ISE and ISE-PIC instances and their current release train (3.0 and earlier, 3.1, 3.2, or 3.3) so you know which fixed release applies.
• Next: Schedule upgrades to the first fixed release for your train: 3.1P10, 3.3P4, or 3.2P8 once available; migrate any 3.0-or-earlier deployment off that train entirely.
• Later: Review administrative role assignments and input-handling controls on ISE going forward, and confirm patch levels as part of routine change management given no workaround exists for issues like these.