CVE-2025-20331: Cisco Identity Services Engine Software · Basic XSS
Affects Cisco Identity Services Engine SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Identity Services Engine Software | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-20331, European organizations should: 1) Immediately audit and restrict access to the Cisco ISE management interface, ensuring only trusted and necessary personnel have low-privileged accounts, and enforce strong authentication mechanisms such as multi-factor authentication (MFA). 2) Monitor and review user input fields in the management interface for suspicious or anomalous entries that could indicate attempted script injection. 3) Implement strict Content Security Policy (CSP) headers on the Cisco ISE web interface to reduce the impact of injected scripts. 4) Regularly update Cisco ISE to the latest available versions or patches once Cisco releases fixes addressing this vulnerability. 5) Conduct security awareness training for administrators to recognize phishing or social engineering attempts that could facilitate credential compromise. 6) Employ network segmentation and monitoring to detect unusual administrative activity or lateral movement originating from compromised accounts. 7) Use web application firewalls (WAFs) with custom rules to detect and block common XSS payloads targeting the Cisco ISE interface. These measures, combined, reduce the likelihood of exploitation and limit potential damage.
Description
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on the affected device.