WaratekVRT Sign in

CVE-2025-20281

Affected software2 products, listed below
Severity10.0 Critical CVSS 3.1
WeaknessCWE-74
Published25 Jun 2025
Updated17 Jun 2026

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-07-28 · remediation due 2025-08-18 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 12 citations · honeypot sightings · 3 exploits · earliest 2025-07-13.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-06-27.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-20281 in VulnCheck (free account), which lists 7 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 26 days 2025-07-13 to 2026-05-25
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 31 days 2026-01-03 to 2026-11-02
Reported exploitation sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 2025-07-21
Reported exploitation cyberscoop.com /cisco-identity-services-engines-active-exploits 2025-07-23
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-07-28
Reported exploitation cert.europa.eu /publications/threat-intelligence/cb25-08 2025-08-04
Reported exploitation fortinet.com /blog/threat-research/iot-malware-gayfemboy-mirai-based-botnet-campaign 2025-08-22
Exploit reference VulnCheck XDB 12b96a1046ce Exploit type: initial-access 2025-07-03
Exploit reference VulnCheck XDB d1c1c258a95b Exploit type: initial-access 2025-07-04
Exploit reference VulnCheck XDB a278a738d5ee Exploit type: initial-access 2025-07-07
IndexArtifactStarsFirst seen
GitHub PoC Unauthenticated Python PoC for CVE-2025-20281 RCE against ISE ERS API 21 2025-06-27
GitHub PoC This script checks for the presence of the **CVE-2025-20281** vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC, which allows **unauthenticated remote code execution (RCE)** as root due to insufficient input validation in a specific API. 8 2025-07-03
GitHub PoC Unauthenticated Remote Code Execution exploit for CVE-2025-20281 in Cisco ISE ERS API. Execute commands or launch reverse shells as root — no authentication required. 5 2025-07-04
Nuclei Cisco ISE - Remote Code Execution

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/identity_services_engine). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

Affected software and releases

Products and versions

2 products, 18 version entries
SourceVendorProductSchemeAffected versions
nvd cisco identity services engine generic 3.3.0 · 3.3.0:patch1 · 3.3.0:patch2 · 3.3.0:patch3 · 3.3.0:patch4 · 3.3.0:patch5 · 3.3.0:patch6 · 3.4.0 · 3.4.0:patch1
nvd cisco identity services engine passive identity connector generic 3.3.0 · 3.3.0:patch1 · 3.3.0:patch2 · 3.3.0:patch3 · 3.3.0:patch4 · 3.3.0:patch5 · 3.3.0:patch6 · 3.4.0 · 3.4.0:patch1

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281 US Government Resource
https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability Exploit, Third Party Advisory

Timeline
Published2025-06-25By the CVE Program.
VulnCheck KEV: earliest evidence2025-07-13Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2025-07-28Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-02Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.