{"id":"CVE-2025-20282","published":"2025-06-25T16:29:12Z","modified":"2026-02-26T17:50:23Z","title":"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability","vendor":"Cisco","product":"Cisco Identity Services Engine Software","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"Cisco Identity Services Engine Software","versions":["3.4.0","3.4 Patch 1"]}],"description":{"text":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","provenance":"source","from":"CVE.org"},"summary":{"text":"A lack of file validation in an internal API of Cisco Identity Services Engine Software (and Cisco ISE-PIC) lets uploaded files be placed in privileged directories on the affected system. An unauthenticated, remote attacker who uploads a crafted file can execute it on the underlying operating system as root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:00Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.38719,"percentile":0.98578,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-20","exploitedFirstSeen":"2026-01-20","ransomware":false,"evidence":[{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://previdian.com/CVE-2025-20282","date":"2026-08-07"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"Kritieke kwetsbaarheden in Cisco ISE en ISE-PIC [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6d0c4f29dda6965850256f","created":"2026-07-31"},{"name":"Actualización Cisco update - 02/08/2025 Known Exploited","url":"https://otx.alienvault.com/pulse/688e5f56f0308af3285b9b87","created":"2025-08-02"},{"name":"Cisco confirms active exploitation of ISE and ISE-PIC flaws","url":"https://otx.alienvault.com/pulse/6881c50f209da31275b4a312","created":"2025-07-24"},{"name":"Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools - Arctic Wolf","url":"https://otx.alienvault.com/pulse/686e548443f3b72db0482f04","created":"2025-07-09"},{"name":"Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools | Arctic Wolf","url":"https://otx.alienvault.com/pulse/686e5468ea3cee78ec2ae913","created":"2025-07-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-19166","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19166","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-07-01","earliestUrl":"https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC","repos":[{"name":"skadevare/CiscoISE-CVE-2025-20282-POC","url":"https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC","stars":1,"created":"2025-07-01"}]},"nuclei":[{"id":"CVE-2025-20282","name":"Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload","severity":"critical","path":"http/cves/2025/CVE-2025-20282.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20282.yaml"}],"first":{"date":"2025-07-01","source":"PoC-in-GitHub","url":"https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-06-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-20282","provenance":"source"},{"date":"2025-07-01","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC","provenance":"source"},{"date":"2026-01-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 283 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.72,"detail":"percentile 0.9858"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}