Critical Unauthenticated RCE Flaws Patched in Cisco ISE and ISE-PIC
Cisco disclosed two critical vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allow unauthenticated remote attackers to execute arbitrary code on the underlying operating system with root privileges. The flaws, tracked as CVE-2025-20281 and CVE-2025-20282, are independent issues, meaning exploitation of one is not required to exploit the other.
CVE-2025-20281 affects Cisco ISE and ISE-PIC version 3.3 and later, while CVE-2025-20282 affects version 3.4 only; Cisco said version 3.2 and earlier are not affected. Cisco also warned that CVE-2025-20282 can enable arbitrary file upload and execution on vulnerable devices. Patches have been released, and organizations running affected deployments have been urged to update immediately.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Cisco releases patches for affected ISE and ISE-PIC versions
Cisco released fixes for the vulnerabilities and advised organizations to update immediately. CVE-2025-20281 affects ISE and ISE-PIC versions 3.3 and later, while CVE-2025-20282 affects version 3.4; version 3.2 and earlier are not affected.
Cisco discloses critical RCE flaws in ISE and ISE-PIC
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) were found to contain two critical vulnerabilities, CVE-2025-20281 and CVE-2025-20282. The flaws allow unauthenticated remote code execution as root, with CVE-2025-20282 also enabling arbitrary file upload and execution on affected devices.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
Kriittisiä haavoittuvuuksia Cisco Identity Services Engine- ja Cisco ISE Passive Identity Connector -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceKriittisiä haavoittuvuuksia Cisco Identity Services Engine- ja Cisco ISE Passive Identity Connector -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco ISE Flaws Expose Networks to RCE and Sensitive Data Disclosure
Cisco disclosed two vulnerabilities in **Cisco Identity Services Engine (ISE)** and **Cisco ISE Passive Identity Connector (ISE-PIC)**, including the critical remote code execution flaw `CVE-2026-20181` and the high-severity information disclosure flaw `CVE-2026-20190`. Cisco said `CVE-2026-20181` carries a CVSS score of **9.1** and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated **7.5**, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks. The affected software includes all releases prior to **3.3**, versions before **3.3 Patch 11** in release 3.3, versions before **3.4 Patch 6** in release 3.4, and versions before **3.5 Patch 4** in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Jun 21, 2026
Cisco ISE Flaws Expose Authentication Bypass, Root RCE, and Path Traversal
Cisco disclosed multiple vulnerabilities in **Identity Services Engine (ISE)** and **ISE-PIC** that could let attackers compromise deployments through **authentication bypass**, **unauthenticated remote code execution**, and **path traversal**. One of the issues, tracked as **`CVE-2025-20281`**, was described in public research as allowing unauthenticated attackers to achieve **remote code execution as root** because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure. Separate Cisco advisories also detailed additional **authentication bypass** weaknesses and a combination of **remote code execution and path traversal** flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for `CVE-2025-20281` increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
May 25, 2026
Critical Cisco ISE Flaws Enable Authenticated RCE and File Exposure
Cisco disclosed two vulnerabilities in **Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** that can allow authenticated attackers to execute malicious code and access sensitive files. The most severe flaw, **`CVE-2026-20147`** with a **CVSS 9.9**, is an authenticated remote code execution issue that can provide user-level operating system access and may be escalated to **root**. A second flaw, **`CVE-2026-20148`** with a **CVSS 4.9**, is an authenticated path traversal vulnerability that can expose files from the underlying operating system.
Apr 20, 2026