Cisco ISE related Vulnerability (CVE-2025-20281 & 20282 & 20337)

[Marcelo Morais]

• Introduction
• Summary
• Workaround
• Affected Products & Fixed Software
• References

The Portuguese version of this Article can be found at: Vulnerabilidade que afeta o Cisco ISE (CVE-2025-20281 & 20282 & 20337) . 

For an offline or printed copy of this document, simply choose ⋮ Options > Printer Friendly Page. You may then Print > Print to PDF or Copy & Paste to any other document format you like.

Introduction

Please be aware of the following CVE (Common Vulnerabilities and Exposures) of CVSS (Common Vulnerability Scoring System) Critical :

CVE-2025-20281, CVE-2025-20282 & CVE-2025-20337 of June 25, 2025 and updated on Jul 16, 2025.

described in:

CVE-2025-20281, 20282 & 20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities

CSCwo99449 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerability.

CSCwp02821 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerability.

CSCwp02814 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerability.

Summary

Multiple vulnerabilities in Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute commands on the Operating System as the root user.

Workaround

There is no Workaround that will solve this vulnerability !!!

Affected Products & Fixed Software

The vulnerability affects Cisco ISE in the following versions (June 25, 2025) : 

and was updated on Jul 16, 2025:

To access the version of Cisco ISE that fixes this CVE:

• 3.3 P6 of June 04, 2025
• 3.3 P7 of July 15, 2025
• 3.4 P2 of June 20, 2025

IMPORTANT: on June 25, 2025 the following hot patches were introduced as part of the fix, but as of July 16, 2025, Cisco recommends upgrading to 3.3 P7 or 3.4 P2 as the hot patches did not address CVE-2025-20337 and have been deferred.

• HP-3.3P4-CSCwo99449  of June 24, 2025
• HP-3.4P1-CSCwo99449 of June 24, 2025

References

Cisco Security Advisories

ISE - CVEs (versão Português) - Video

[Jack S]

Good morning,

EDIT: The patch 4 is a hotpatch, rather than a full patch. Please discard my previous comment.

Please could I get some clarity around the fixed releases, specifically for CVE-2025-20281?
We have a multi-node deployment running 3.3 patch 4.

It states for the 3.3 release, that patch 6 is the fixed release. But underneath it also states that patch 4 is also a fixed release (with the patch filename string).

Is this true? Or is patch 4 in there by mistake? Just with ISE patches being cumulative, I would have expected only patch 4 being mentioned, or it also including patch 5 in that list.

Thanks

[-dac-]

I have a very simple question: For CVE-2025-20281, does anybody know if disabling REST API will work? Because Advisory clearly says there is no workaround.

In the bug it appears a thread about this discussion, however unfortunately I do not have access to it:

CSCwo99449 - ISE Unauthenticated Remote Code Execution Vulnerability

disable REST API on ISE will this vulnerability be still applicable? Also, is 3.3 patch 4 HP for CSCwo99449 available for download?

[Marcelo Morais]

Hi @Jack S ,

 yes, you are correct, the HP-3.3P4-CSCwo99449 is a hotpatch, it is not the ISE 3.3 P4.

[Marcelo Morais]

Hi @-dac- ,

 the info about:

CSCwo99449 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerability

the link for the ISE 3.3 P4 hotpatch is HP-3.3P4-CSCwo99449.

[Arne Bier]

Hi @Marcelo Morais 

Thanks for posting this.

When I click on the link you provided for CVE-2025-20281/282, it takes me to the CVE-2025-20286! If that was intentional, I think you ought to make clear at the start, that CVE-2025-20286 affects only the cloud instances of ISE, and do not affect the on-premise versions of ISE. Before people start panicking. Nothing wrong with patching, but the devil is always in the details.

[Marcelo Morais]

Hi @Arne Bier ,

 many thanks my friend ... I updated the link !!!

[Brian66351]

Hi @Marcelo Morais 

Please confirm if below still applies:

"If you installed a hot patch on your previous Cisco ISE release, you must roll back the hot patch before installing a patch. Otherwise, the services might not be started due to an integrity check security issue."

I installed HP-CLOUD-CSCwn63400 on ISE 3.3 Patch 4. I need to rollback the hot patch first before installing Patch 6?

[Marcelo Morais]

Hi @Brian66351 ,

 you are talking about this: Cisco ISE related Vulnerability (CVE-2025-20286) ... please, take a look at the IMPORTANT info at the end of this Article.

 You do not nee to rollback the HP before installing P6.

Hope this helps !!!

[Brian66351]

Yes @Marcelo Morais, that is the HP I am referring to.

The release note document for ISE 3.3 has this warning.

Seems to contradict the Vulnerability document.

[Marcelo Morais]

Hi @Brian66351 ,

 not all HP need to be rollback before an update, another example of this is:

CSCwi06794  - Live log delay (RADIUS) - Regression for CSCwe00424 

Note: if you prefer to rollback the HP, please take a look at Cisco ISE related Vulnerability (CVE-2025-20286) at the end of the Article there is a " ... To access the Cisco ISE version that fixes this CVE ..."

Hope this helps !!!

[Brian66351]

Noted @Marcelo Morais, thank you. 

I will proceed with the update without the rollback.

[cghaderpour]

Hello guys.

My deployment is as follow on cloud and on-prem: 

Version: 3.3.0.430

Patch Information: 4,5

Can I just install the patch 6 on top of what I currently have?

Is there anyone here that has already installed patch 6? Is there any additional impact of patch 6 installation that we must be aware of? 

[Marcelo Morais]

Hi @cghaderpour ,

 yes, you can install patch 6 on top of patch 4 & 5.

Release 3.3 P6 is the Suggested Release and resolve two important caveats from P5, please take a look at ISE Release Notes 3.3, search for Resolved caveats in Cisco ISE release 3.3 cumulative Patch 6.

[CiscoU9834]

It seems that they've updated the advisory and hot patches have deferred from CCO, due to the release of 3.3 Patch7

• If Cisco ISE is running Release 3.3 Patch 6, additional fixes are available in Release 3.3 Patch 7, and the device must be upgraded.
• If Cisco ISE has either hot patch ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz or hot patch ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz installed, Cisco recommends upgrading to Release 3.3 Patch 7 or Release 3.4 Patch 2. The hot patches did not address CVE-2025-20337 and have been deferred from CCO.

[Marcelo Morais]

Hi @CiscoU9834 ,

 Article updated !!!