---
title: "Cisco ISE CVE-2025-20281/20337: Unauthenticated Root RCE"
url: https://erroneo.us/security/briefs/cisco-ise-cve-2025-20281-20337-unauth-root-rce/
description: "CVSS 10 API flaws in Cisco ISE and ISE-PIC 3.3/3.4 give unauthenticated root; exploited as a zero-day. Fixed in 3.3 Patch 7 and 3.4 Patch 2. Verify and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-06-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-20281", "CVE-2025-20337"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco ISE CVE-2025-20281/20337: Unauthenticated Root RCE

**Verdict: Check exposure.** Patched since July 2025 but used as a zero-day by a well-resourced actor: confirm every ISE node is on 3.3 Patch 7 / 3.4 Patch 2 or later, and treat nodes that were reachable and unpatched in mid-2025 as possibly compromised.

- **Who must act:** Anyone who ran Cisco ISE or ISE-PIC 3.3 or 3.4 in 2025, especially nodes that stayed below 3.3 Patch 7 or 3.4 Patch 2, or relied on the June 2025 hot patch.
- **Who can relax:** ISE 3.2 and earlier (not affected) and deployments already on 3.3 Patch 7, 3.4 Patch 2 or any later patch whose nodes were never reachable from untrusted networks.
- **Affected:** Cisco ISE and ISE-PIC 3.3 before Patch 7; Cisco ISE and ISE-PIC 3.4 before Patch 2; Nodes running only the CSCwo99449 hot patch (does not fix CVE-2025-20337)
- **Fixed:** ISE/ISE-PIC 3.3 Patch 7; ISE/ISE-PIC 3.4 Patch 2; Any later patch on those trains
- **CVEs:** CVE-2025-20281, CVE-2025-20337
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. On every ISE node run show version (or check Administration > System > Maintenance > Patch Management) and confirm 3.3 Patch 7 / 3.4 Patch 2 or later.
2. Replace any CSCwo99449 hot patch with the full patch; the hot patch does not fix CVE-2025-20337.
3. Restrict ISE admin and API interfaces to management networks; nothing but RADIUS/TACACS+ and portal traffic should reach ISE from user or internet segments.
4. If a node was reachable and unpatched in June-July 2025, open a Cisco TAC case, reimage it, and rotate ISE admin, AD join and network-device shared secrets.

### How to check if you are affected

- Search web and proxy logs for requests to /deployment-rpc/enableStrongSwanTunnel from anything other than ISE nodes.
- Look for unexpected processes or outbound connections from ISE nodes, especially children of the Java/Tomcat process or the strongswan container.
- Hunt for an in-memory Tomcat listener masquerading as IdentityAuditAction (Amazon's finding); a restart and reimage is the safest cleanup.
- Review ISE admin audit logs for new admins, policy changes and certificate or endpoint exports during mid-2025.

## What happened

On June 25, 2025, Cisco published [cisco-sa-ise-unauth-rce-ZAd2GnJ6](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6) for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). [CVE-2025-20281](https://www.cve.org/CVERecord?id=CVE-2025-20281) lets an unauthenticated remote attacker send a crafted request to a specific API and run commands as root, because user input is not properly validated. On July 16, Cisco added [CVE-2025-20337](https://www.cve.org/CVERecord?id=CVE-2025-20337), a second bug of the same class in the same API, and replaced its earlier code fix. Both are rated CVSS 3.1 10.0. A third CVE in the advisory, CVE-2025-20282 (a file upload flaw in 3.4 only), is not in KEV.

Cisco updated the advisory on July 21 to say it had seen attempted exploitation, and named both CVEs on July 25. CISA added both to KEV on July 28, 2025. By then [ZDI's Bobby Gould](https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability), who reported CVE-2025-20281, had published a write-up. It shows a deserialization and command injection in `/deployment-rpc/enableStrongSwanTunnel` that gives root in a privileged container, plus a cgroup escape to root on the host. In November 2025, [Amazon](https://aws.amazon.com/blogs/security/amazon-discovers-apt-exploiting-cisco-and-citrix-zero-days/) reported that a "highly resourced" actor exploited CVE-2025-20337 "before Cisco had assigned a CVE number." Amazon says the actor dropped an in-memory web shell disguised as an ISE component called IdentityAuditAction.

## Who is affected

ISE and ISE-PIC 3.3 and 3.4, in any configuration. Releases 3.2 and earlier are not affected. The fixes are 3.3 Patch 7 and 3.4 Patch 2. Cisco warns that the earlier CSCwo99449 hot patch for 3.3 Patch 4 and 3.4 Patch 1 does not fix CVE-2025-20337, and it was pulled from the download site. There are no workarounds.

## Do you really need to act?

ISE decides who gets onto your network and holds AD join credentials, RADIUS and TACACS+ secrets, and certificates. Root on it is a serious foothold. Fifteen months on, most deployments should have moved well past Patch 7/Patch 2. If yours did, this is a verification exercise. The open question is what happened before you patched. Exploitation began as a zero-day, a detailed write-up was public by late July, and the web shell Amazon found lives in memory.

A different ISE API flaw, CVE-2026-76460, was exploited in September 2026 and has its own brief. ISE patches are cumulative, so the newer patch levels that fix it also cover these bugs. Patching does not answer whether you were compromised in 2025, though.

## What to do now

1. On each node, run `show version` from the ISE CLI, or check Administration > System > Maintenance > Patch Management. Confirm 3.3 Patch 7 or 3.4 Patch 2 or later.
2. If any node still runs a CSCwo99449 hot patch, install the full patch.
3. Make sure ISE admin and API interfaces are reachable only from management networks.
4. For nodes that were reachable and unpatched in June or July 2025, open a TAC case and reimage from trusted media. Then rotate ISE admin passwords, the AD join account, network-device shared secrets and any exported certificates.

## How to tell if you were hit

Search reverse-proxy, load-balancer or firewall logs for requests to `/deployment-rpc/enableStrongSwanTunnel` that came from anything other than your own ISE nodes. On the nodes, look for unexpected child processes of the Java/Tomcat service or the strongSwan container, and for outbound connections ISE has no reason to make. Amazon's web shell registered itself as a Tomcat listener and gated access on specific HTTP headers, so file-based scans may miss it. Review the ISE admin audit log for new administrators, policy changes and exports from mid-2025. [Coverage at the time](https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-cisco-ise-bug-exploited-in-attacks/) stressed that the write-up was detailed enough to rebuild the exploit, so expect opportunistic attempts as well as the targeted ones.

## Timeline

- Jun 25, 2025 — Cisco discloses CVE-2025-20281 and CVE-2025-20282.
- Jul 16, 2025 — Cisco adds CVE-2025-20337 and new fixes (3.3 Patch 7, 3.4 Patch 2).
- Jul 21, 2025 — Cisco reports exploitation attempts in the wild.
- Jul 25, 2025 — ZDI publishes the CVE-2025-20281 exploit write-up.
- Jul 28, 2025 — CISA adds both CVEs to KEV (due Aug 18, 2025).
- Nov 12, 2025 — Amazon reports zero-day exploitation of CVE-2025-20337.

## Sources

1. [Cisco — Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities (cisco-sa-ise-unauth-rce-ZAd2GnJ6)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6)
2. [CVE record — CVE-2025-20281](https://www.cve.org/CVERecord?id=CVE-2025-20281)
3. [CVE record — CVE-2025-20337](https://www.cve.org/CVERecord?id=CVE-2025-20337)
4. [NVD — CVE-2025-20337](https://nvd.nist.gov/vuln/detail/CVE-2025-20337)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-20281](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-20337](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337)
7. [Trend Micro ZDI (Bobby Gould) — CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability)
8. [Amazon (CJ Moses) — Amazon discovers APT exploiting Cisco and Citrix zero-days](https://aws.amazon.com/blogs/security/amazon-discovers-apt-exploiting-cisco-and-citrix-zero-days/)
9. [BleepingComputer — Exploit available for critical Cisco ISE bug exploited in attacks](https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-cisco-ise-bug-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/cisco-ise-cve-2025-20281-20337-unauth-root-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt