CVE-2025-20281 Cisco Identity Services Engine Injection

Exploited in the wild Critical 10.0 Published 25 Jun 2025 Updated 26 Feb 2026

Unauthenticated remote attackers can execute arbitrary code as root on Cisco ISE devices via crafted API requests due to insufficient input validation.

Exploited in the wild: Since 28 Jul 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20281?

CVE-2025-20281 is a critical code injection vulnerability in Cisco Identity Services Engine, published on 25 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Weakness: CWE-74

Which versions are affected by CVE-2025-20281?

It affects 2 products.

Products include Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector.

How do I fix CVE-2025-20281?

No fix has been published for CVE-2025-20281 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Aug 2025.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-20281 being exploited?

Yes. Attackers have exploited CVE-2025-20281 in the wild since at least 28 Jul 2025.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-rc4f-42xm-hvjw.