CVE-2025-20281CRITICAL 10.0CISA KEVEPSS p99.9%

CVE-2025-20281Cisco Identity Services Engine Injection Vulnerability

Cisco / Identity Services Engine

Description

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.

Scoring

CVSS 3.110.0 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS96.73% probability of exploitation · percentile 99.9% · 2026-06-17T12:03:21Z
Published2025-06-25
Last modified2025-10-28

CISA KEV entry

Added to KEV: 2025-07-28

Underlying weaknesses· 1

CWE-74

References

  1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
  2. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281
  3. https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-740%live

(incoming)1

TypeTargetConfidenceTier
KEVEntryCisco Identity Services Engine Injection Vulnerabilitykev-cve-2025-202810%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-20282
CVE
CVE-2026-20180
CVE
CVE-2026-20186
CVE
CVE-2026-20147
CVE
CVE-2025-20334
CVE
CVE-2025-20286
Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.