Cisco ISE Flaws Expose Authentication Bypass, Root RCE, and Path Traversal

Cisco disclosed multiple vulnerabilities in Identity Services Engine (ISE) and ISE-PIC that could let attackers compromise deployments through authentication bypass, unauthenticated remote code execution, and path traversal. One of the issues, tracked as CVE-2025-20281, was described in public research as allowing unauthenticated attackers to achieve remote code execution as root because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure.

Separate Cisco advisories also detailed additional authentication bypass weaknesses and a combination of remote code execution and path traversal flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for CVE-2025-20281 increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.