CVE-2025-20282 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Critical 10.0 Published 25 Jun 2025 Updated 26 Feb 2026

Unauthenticated remote attackers can upload and execute arbitrary files as root on Cisco ISE devices due to missing file validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20282?

CVE-2025-20282 is a critical vulnerability in Cisco Identity Services Engine, published on 25 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

Weakness: CWE-269

Which versions are affected by CVE-2025-20282?

It affects 2 products.

Products include Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector.

How do I fix CVE-2025-20282?

No fix has been published for CVE-2025-20282 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-20282 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-20282 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-w8p2-wjjr-hr24.