Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-20281

CVE-2025-20281CRITICAL

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .9760   99.9   YES

AFFECTED
  Product                                  Versions  Fixed
  Cisco Identity Services Engine Software  3.3.0 –   —

TIMELINE
  Oct 10  Reserved by cisco
  Jun 25  Published (CNA: cisco)
  Jul 28  Added to CISA KEV, remediation due 2025-08-18

CWE-74 · CNA: cisco · CVSS v3.1 · 3 references · KEV due August 18, 2025

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 10, 2024	Reserved	Reserved by cisco
June 25, 2025	Published	Published (CNA: cisco)
July 28, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-08-18

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Cisco	Cisco Identity Services Engine Software	—	3.3.0	—

Weaknesses

CWE-74

References (3)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281 [government-resource]
https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability [exploit, technical-description]

Authoritative record: CVE-2025-20281 at cve.org

Vendors: cisco

Weaknesses: CWE-74

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-20281 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.