WaratekVRT Sign in

CVE-2025-20286 Cisco Identity Services Engine

Affected softwareCisco Identity Services Engine
Severity9.9 Critical CVSS 3.1 2 scores
WeaknessCWE-259
Published4 Jun 2025
Updated17 Jun 2026

Description

A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published a year ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.2% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/identity_services_engine). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

9.9 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H psirt@cisco.com Secondary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary

Affected software and releases

Products and versions

1 product, 27 version entries
SourceVendorProductSchemeAffected versions
nvd cisco identity services engine generic 3.1.0 · 3.1.0:patch1 · 3.1.0:patch2 · 3.1.0:patch3 · 3.1.0:patch4 · 3.1.0:patch5 · 3.1.0:patch6 · 3.1.0:patch7 · 3.1.0:patch8 · 3.1.0:patch9 · 3.1.0:patch10 · 3.2.0 · 3.2.0:patch1 · 3.2.0:patch2 · 3.2.0:patch3 · 3.2.0:patch4 · 3.2.0:patch5 · 3.2.0:patch6 · 3.2.0:patch7 · 3.3.0 · 3.3.0:patch1 · 3.3.0:patch2 · 3.3.0:patch3 · 3.3.0:patch4 · 3.3.0:patch5 · 3.4.0 · 3.4.0:patch1

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7 Vendor Advisory

Timeline
Published2025-06-04By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.