CVE-2025-20284: Cisco Identity Services Engine Software · Injection
Affects Cisco Identity Services Engine SoftwareSource CVE Database V5
Not known to be exploited · 25% EPSS · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 25.1% chance of exploitation in 30 days – higher than 97% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Identity Services Engine Software | Affected
| Fixed in– |
AI-suggested
- Immediately apply the latest patches and updates provided by Cisco for all affected Cisco ISE versions to remediate the vulnerability.
- Restrict API access strictly to trusted administrators and systems, employing network segmentation and access control lists to limit exposure.
- Enforce strong authentication mechanisms and regularly audit high-privileged accounts to detect unauthorized access or credential misuse.
- Implement robust monitoring and logging of API usage and system commands to identify suspicious activities indicative of exploitation attempts.
- Use multi-factor authentication (MFA) for all administrative access to reduce the risk of credential compromise.
- Conduct regular security assessments and penetration testing focused on Cisco ISE deployments to uncover potential weaknesses.
- Consider deploying intrusion detection/prevention systems (IDS/IPS) tuned to detect anomalous API requests or command injection patterns targeting Cisco ISE.
- Maintain an incident response plan specifically addressing potential compromises of network access control infrastructure.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.