Cisco on Wednesday announced patches for two critical-severity vulnerabilities in Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could lead to remote code execution (RCE).
Exploitable without authentication, the two flaws are tracked as CVE-2025-20281 and CVE-2025-20282 and have the maximum severity score of 10/10. Both impact specific APIs within the affected products.
CVE-2025-20281 exists because user-supplied input is insufficiently validated, allowing remote, unauthenticated attackers to submit crafted API requests and execute arbitrary code with root privileges.
CVE-2025-20282 exists because a lack of file validation checks allows attackers to place arbitrary files in privileged directories on a vulnerable system.
“An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system,” Cisco explains in its advisory.
The bugs are not dependent on one another, and the exploitation of either of them does not require that the other is exploited. Furthermore, Cisco says, software versions affected by one flaw may not be impacted by the other.
CVE-2025-20281 affects ISE and ISE-PIC releases 3.3 and later, and was fixed in ISE and ISE-PIC versions 3.3 patch 6 and 3.4 patch 2. CVE-2025-20282 only affects ISE and ISE-PIC release 3.4, regardless of device configuration, and was addressed in ISE and ISE-PIC 3.4 patch 2.
Given the critical severity of both vulnerabilities, users are advised to apply the available patches as soon as possible.
On Wednesday, Cisco also announced fixes for a medium-severity ISE flaw that could allow remote attackers to bypass authorization mechanisms and modify specific system settings, including some leading to a system restart.
Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page.
Related: High-Severity Vulnerabilities Patched by Cisco, Atlassian
Related: Cisco Patches Critical ISE Vulnerability With Public PoC
Related: Technical Details Published for Critical Cisco IOS XE Vulnerability
