CVE-2025-20281: Cisco ISE API unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable root code execution with CVSS 10, KEV listing and near-certain EPSS probability makes this an urgent patch.

What it is

Cisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, allowing a crafted request to reach the underlying operating system. Because the flaw is reachable without credentials and yields root, it is a full compromise of the appliance.

Impact

An unauthenticated remote attacker gains root-level code execution on the ISE or ISE-PIC host, giving control of the appliance and any identity data or trust relationships it holds.

Attack surface

Reached over the network via a crafted API request; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required.

Exploitation

CVE-2025-20281 is listed in CISA KEV with a 2025-08-18 remediation due date, and a third-party advisory carries an Exploit tag; EPSS 30-day probability is 0.9723. No ransomware campaign use is documented.

What to do

• Apply the Cisco security advisory fix for ISE and ISE-PIC immediately; this is a KEV-listed flaw with a federal due date.
• If patching cannot be completed at once, restrict network access to the affected API to trusted management networks only.
• Audit and disable any unnecessary external exposure of ISE management and API interfaces.
• After patching, rotate credentials and review the appliance for signs of tampering, since root access may have been obtained.
• Track BOD 22-01 guidance and confirm remediation status against the KEV due date.

Detection

• Review ISE API and web access logs for crafted or anomalous requests to the affected API endpoint, especially from unexpected source addresses.
• Monitor for unexpected processes, child processes of web/API services, or new files on the ISE host that indicate command execution.
• Alert on outbound connections from ISE appliances to unfamiliar hosts, which may indicate post-exploitation activity.
• Correlate authentication and configuration changes on ISE with API request logs to spot unauthorized administrative activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.