topic Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities in Network Access Control

Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

adamscottmaster2013 — Sun, 20 Jul 2025 19:32:12 GMT

Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities

It stated that: "If Cisco ISE is running Release 3.3 Patch 6, additional fixes are available in Release 3.3 Patch 7, and the device must be upgraded". What the hell does this even mean "must be upgraded"?

I just patched my ISE system from 3.3 patch-4 to 3.3 patch-6 three days.

Can someone clarify this? TIA

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

balaji.bandi — Sun, 20 Jul 2025 20:01:29 GMT

yes even you patched yesterday, you need to patch today to be secure. (i know its not a great practice, this what it is now a days).

We all are in same boat.

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

adamscottmaster2013 — Sun, 20 Jul 2025 20:34:54 GMT

Hi @balaji.bandi: What does this statement mean "If Cisco ISE is running Release 3.3 Patch 6, additional fixes are available in Release 3.3 Patch 7, and the device must be upgraded." What does Cisco mean when it says "upgraded" as oppose to "fresh install"?

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

balaji.bandi — Sun, 20 Jul 2025 21:36:53 GMT

As per i know there is no need of fresh install you can just patch on top of the patch, patch 7 recent security fix.

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

adamscottmaster2013 — Sun, 20 Jul 2025 21:50:30 GMT

That is my understanding as well, but I question why Cisco put in that statement in the first place. Something doesn't seem right.

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

julian.bendix — Sun, 20 Jul 2025 22:20:05 GMT

They are just using the term upgrading in a sense of patching. In this case upgrade means installing patch 7 as patches are always installed.

I know it's frustrating, but as @balaji.bandi also said.. it is what it is and we are all in the same boat.

They found a new security breach and released a patch to fix it - that sometimes happens multiple times shortly after another..

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

balaji.bandi — Mon, 21 Jul 2025 07:01:23 GMT

I totally understand customer point of view, but being security product, they may have found later security vulnerability , they release patch, this what software industry, since as a consumer we expect fast phasing new feature every when and then.

patch not much time to apply, but planning is takes time and if this is single node required small maintenance window, if the deployment is distributed then you have better options.

Re: Cisco ISE Unauthenticated Remote Code Execution Vulnerabilities

WLRK.Infrastructure — Mon, 21 Jul 2025 13:24:30 GMT

No hotfix, just a patch upgrade.... sigh...