erroneo.us
Search all guides⌘K

Security Digest · Jun 25, 2025 · Vulnerability · Identity

Cisco ISE CVE-2025-20281/20337: Unauthenticated Root RCE

CVSS 10 API flaws in Cisco ISE and ISE-PIC 3.3/3.4 give unauthenticated root; exploited as a zero-day. Fixed in 3.3 Patch 7 and 3.4 Patch 2. Verify and hunt.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Patched since July 2025 but used as a zero-day by a well-resourced actor: confirm every ISE node is on 3.3 Patch 7 / 3.4 Patch 2 or later, and treat nodes that were reachable and unpatched in mid-2025 as possibly compromised.

Who must act: Anyone who ran Cisco ISE or ISE-PIC 3.3 or 3.4 in 2025, especially nodes that stayed below 3.3 Patch 7 or 3.4 Patch 2, or relied on the June 2025 hot patch.

Who can relax: ISE 3.2 and earlier (not affected) and deployments already on 3.3 Patch 7, 3.4 Patch 2 or any later patch whose nodes were never reachable from untrusted networks.

Affected
Cisco ISE and ISE-PIC 3.3 before Patch 7
Cisco ISE and ISE-PIC 3.4 before Patch 2
Nodes running only the CSCwo99449 hot patch (does not fix CVE-2025-20337)
Fixed in
ISE/ISE-PIC 3.3 Patch 7
ISE/ISE-PIC 3.4 Patch 2
Any later patch on those trains
CVSS
10.0 (v3.1, vendor)
EPSS
97.6% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. On every ISE node run show version (or check Administration > System > Maintenance > Patch Management) and confirm 3.3 Patch 7 / 3.4 Patch 2 or later.
  2. Replace any CSCwo99449 hot patch with the full patch; the hot patch does not fix CVE-2025-20337.
  3. Restrict ISE admin and API interfaces to management networks; nothing but RADIUS/TACACS+ and portal traffic should reach ISE from user or internet segments.
  4. If a node was reachable and unpatched in June-July 2025, open a Cisco TAC case, reimage it, and rotate ISE admin, AD join and network-device shared secrets.

How to check if you are affected or compromised

  • Search web and proxy logs for requests to /deployment-rpc/enableStrongSwanTunnel from anything other than ISE nodes.
  • Look for unexpected processes or outbound connections from ISE nodes, especially children of the Java/Tomcat process or the strongswan container.
  • Hunt for an in-memory Tomcat listener masquerading as IdentityAuditAction (Amazon's finding); a restart and reimage is the safest cleanup.
  • Review ISE admin audit logs for new admins, policy changes and certificate or endpoint exports during mid-2025.

What happened#

On June 25, 2025, Cisco published cisco-sa-ise-unauth-rce-ZAd2GnJ6 for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). CVE-2025-20281 lets an unauthenticated remote attacker send a crafted request to a specific API and run commands as root, because user input is not properly validated. On July 16, Cisco added CVE-2025-20337, a second bug of the same class in the same API, and replaced its earlier code fix. Both are rated CVSS 3.1 10.0. A third CVE in the advisory, CVE-2025-20282 (a file upload flaw in 3.4 only), is not in KEV.

Cisco updated the advisory on July 21 to say it had seen attempted exploitation, and named both CVEs on July 25. CISA added both to KEV on July 28, 2025. By then ZDI's Bobby Gould, who reported CVE-2025-20281, had published a write-up. It shows a deserialization and command injection in /deployment-rpc/enableStrongSwanTunnel that gives root in a privileged container, plus a cgroup escape to root on the host. In November 2025, Amazon reported that a "highly resourced" actor exploited CVE-2025-20337 "before Cisco had assigned a CVE number." Amazon says the actor dropped an in-memory web shell disguised as an ISE component called IdentityAuditAction.

Who is affected#

ISE and ISE-PIC 3.3 and 3.4, in any configuration. Releases 3.2 and earlier are not affected. The fixes are 3.3 Patch 7 and 3.4 Patch 2. Cisco warns that the earlier CSCwo99449 hot patch for 3.3 Patch 4 and 3.4 Patch 1 does not fix CVE-2025-20337, and it was pulled from the download site. There are no workarounds.

Do you really need to act?#

ISE decides who gets onto your network and holds AD join credentials, RADIUS and TACACS+ secrets, and certificates. Root on it is a serious foothold. Fifteen months on, most deployments should have moved well past Patch 7/Patch 2. If yours did, this is a verification exercise. The open question is what happened before you patched. Exploitation began as a zero-day, a detailed write-up was public by late July, and the web shell Amazon found lives in memory.

A different ISE API flaw, CVE-2026-76460, was exploited in September 2026 and has its own brief. ISE patches are cumulative, so the newer patch levels that fix it also cover these bugs. Patching does not answer whether you were compromised in 2025, though.

What to do now#

  1. On each node, run show version from the ISE CLI, or check Administration > System > Maintenance > Patch Management. Confirm 3.3 Patch 7 or 3.4 Patch 2 or later.
  2. If any node still runs a CSCwo99449 hot patch, install the full patch.
  3. Make sure ISE admin and API interfaces are reachable only from management networks.
  4. For nodes that were reachable and unpatched in June or July 2025, open a TAC case and reimage from trusted media. Then rotate ISE admin passwords, the AD join account, network-device shared secrets and any exported certificates.

How to tell if you were hit#

Search reverse-proxy, load-balancer or firewall logs for requests to /deployment-rpc/enableStrongSwanTunnel that came from anything other than your own ISE nodes. On the nodes, look for unexpected child processes of the Java/Tomcat service or the strongSwan container, and for outbound connections ISE has no reason to make. Amazon's web shell registered itself as a Tomcat listener and gated access on specific HTTP headers, so file-based scans may miss it. Review the ISE admin audit log for new administrators, policy changes and exports from mid-2025. Coverage at the time stressed that the write-up was detailed enough to rebuild the exploit, so expect opportunistic attempts as well as the targeted ones.

Timeline#

  • — Cisco discloses CVE-2025-20281 and CVE-2025-20282.
  • — Cisco adds CVE-2025-20337 and new fixes (3.3 Patch 7, 3.4 Patch 2).
  • — Cisco reports exploitation attempts in the wild.
  • — ZDI publishes the CVE-2025-20281 exploit write-up.
  • — CISA adds both CVEs to KEV (due Aug 18, 2025).
  • — Amazon reports zero-day exploitation of CVE-2025-20337.

Vulnerability records

  • CVE-2025-20281 · KEV 2025-07-28 · A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying…
  • CVE-2025-20337 · KEV 2025-07-28 · A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities (cisco-sa-ise-unauth-rce-ZAd2GnJ6) sec.cloudapps.cisco.com
  2. CVE record — CVE-2025-20281 cve.org
  3. CVE record — CVE-2025-20337 cve.org
  4. NVD — CVE-2025-20337 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2025-20281 cisa.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-20337 cisa.gov
  7. Trend Micro ZDI (Bobby Gould) — CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability zerodayinitiative.com
  8. Amazon (CJ Moses) — Amazon discovers APT exploiting Cisco and Citrix zero-days aws.amazon.com

Coverage and analysis

  1. BleepingComputer — Exploit available for critical Cisco ISE bug exploited in attacks bleepingcomputer.com