CVE-2025-20284: Cisco Identity Services Engine Software · Injection
Affects Cisco Identity Services Engine SoftwareSource CVE Database V5
Not known to be exploited · 25% EPSS · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 25.1% chance of exploitation in 30 days – higher than 97% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Identity Services Engine Software | Affected
| Fixed in– |
AI-suggested
1. Immediately apply the latest patches and updates provided by Cisco for all affected Cisco ISE versions to remediate the vulnerability. 2. Restrict API access strictly to trusted administrators and systems, employing network segmentation and access control lists to limit exposure. 3. Enforce strong authentication mechanisms and regularly audit high-privileged accounts to detect unauthorized access or credential misuse. 4. Implement robust monitoring and logging of API usage and system commands to identify suspicious activities indicative of exploitation attempts. 5. Use multi-factor authentication (MFA) for all administrative access to reduce the risk of credential compromise. 6. Conduct regular security assessments and penetration testing focused on Cisco ISE deployments to uncover potential weaknesses. 7. Consider deploying intrusion detection/prevention systems (IDS/IPS) tuned to detect anomalous API requests or command injection patterns targeting Cisco ISE. 8. Maintain an incident response plan specifically addressing potential compromises of network access control infrastructure.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.