CVE-2025-20285: Cisco Identity Services Engine Software · Authentication Bypass by Assumed-Immutable Data
Affects Cisco Identity Services Engine SoftwareSource CVE Database V5
Not known to be exploited · CVSS 4.1 Medium.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Identity Services Engine Software | Affected
| Fixed in– |
AI-suggested
- Immediately review and restrict administrative credential distribution and usage to minimize risk of credential compromise.
- Implement multi-factor authentication (MFA) for all administrative access to Cisco ISE to reduce the risk of credential misuse.
- Monitor administrative login logs for unusual IP addresses or access patterns that violate expected IP restrictions.
- Use network-level controls such as firewall rules or VPN segmentation to further restrict access to Cisco ISE management interfaces.
- Apply Cisco security advisories and patches promptly once available to address this vulnerability.
- Consider additional compensating controls such as just-in-time access or privileged access management solutions to limit exposure.
- Conduct regular audits of IP access restriction configurations to ensure they are correctly applied and enforced.
- If patching is delayed, temporarily disable or limit the IP Access Restriction feature and rely on alternative access controls.
- Educate administrators on the importance of secure credential handling and recognizing suspicious login activity.
- Employ network anomaly detection tools to identify potential unauthorized access attempts from disallowed IPs.
Description
A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to improper enforcement of access controls that are configured using the IP Access Restriction feature. An attacker could exploit this vulnerability by logging in to the API from an unauthorized source IP address. A successful exploit could allow the attacker to gain access to the targeted device from an IP address that should have been restricted. To exploit this vulnerability, the attacker must have valid administrative credentials.