CVE-2025-20281: Unauthenticated Root RCE in Cisco Identity Services Engine (ISE) API

HERMES

HERMES THREAT SCORE & ZERO TRUST NETWORK ACCESS CONTROL

Target: Cisco Identity Services Engine (ISE) & ISE-PIC

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2025-20281 at an HTS of 98 (CRITICAL). Rated CVSS 10.0 and present on CISA KEV with an EPSS score surpassing 97%, this flaw targets the foundational identity and network admission enforcement engine. Unauthenticated remote adversaries gain root access, bypass network admission, and compromise enterprise directory integrations.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-20281: Unauthenticated Root RCE in Cisco Identity Services Engine (ISE) APIVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTCisco Identity Services Engine (ISE)

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Identity Services Engine (ISE) documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	`CVE-2025-20281`	Cisco Advisory `cisco-sa-ise-unauth-rce-ZAd2GnJ6`
Associated CWE	`CWE-74`: Injection	Shell metacharacter injection in REST API endpoints
CVSS v3.1 Score	10.0 CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
Applicable CPEs	`cpe:2.3:a:cisco:identity_services_engine:3.3:::::::` `cpe:2.3:a:cisco:identity_services_engine:3.4:::::::`	Cisco ISE Policy Administration Nodes (PAN)
Affected Versions	3.3 (`< 3.3 Patch 7`), 3.4 (`< 3.4 Patch 2`)	Deployments with ERS API or administrative services reachable
Fixed Versions	ISE 3.3 Patch 7, ISE 3.4 Patch 2	Final cumulative fixes (interim hot patches deferred)

2. Exploitation

CISA KEV: Added on July 28, 2025.
EPSS Score: 0.97093 (Percentile: 99.88%).
Public PoC: Fully weaponized remote exploit scripts available publicly (abrewer251/CVE-2025-20281-2-Cisco-ISE-RCE).
Attack Mechanics: The ERS API user creation endpoint fails to enforce authentication. By injecting command separators into the name parameter of an InternalUser payload, attackers obtain unauthenticated command execution as root.

3. Detection and Forensics

Sigma Rule

title: Cisco ISE Unauthenticated ERS API RCE (CVE-2025-20281)
id: 20281-cisco-ise-api-rce-en
status: production
description: Detects command injection payloads directed at Cisco ISE ERS user administration endpoints.
logsource:
  category: webserver
  product: cisco_ise
detection:
  selection_url:
    cs-method: 'POST'
    cs-uri-stem|contains: '/ers/'
  selection_payload:
    cs-uri-query|contains:
      - ';'
      - '&'
      - '`'
      - '$('
  condition: selection_url and selection_payload
level: critical

MITRE ATT&CK

T1190: Exploit Public-Facing Application
T1059.004: Unix Shell
T1078: Valid Accounts
T1556: Modify Authentication Process

4. Remediation and Hardening

Apply Definitive Upgrade: Upgrade immediately to Release 3.3 Patch 7 or Release 3.4 Patch 2. Note that earlier hot patches (CSCwo99449) were retracted by Cisco due to unaddressed chaining risks with CVE-2025-20337.
Restrict ERS API Access: Disable ERS API if unused or restrict management traffic to dedicated administration networks using strict firewall access rules.

5. Enterprise Exploitation Scenario

« What happens if this vulnerability is exploited in an enterprise? »
Section titled “« What happens if this vulnerability is exploited in an enterprise? »”

Zero Trust Perimeter Invalidation: An adversary targets the Cisco ISE management interface and executes shell commands as root without supplying credentials.

Network Admission Manipulation: Controlling the policy decision point, the attacker alters 802.1X authorization profiles, granting unauthorized rogue hardware access to restricted VLANs.

Identity Secrets Theft: The attacker extracts Active Directory service account hashes, RADIUS pre-shared keys for corporate switches, and TLS trust anchors.

Network-Wide Lateral Expansion: Network segmentation controls are neutralized from within the primary authentication orchestrator, exposing previously isolated database enclaves.