Cisco ISE remote code execution flaws require immediate patching
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two unauthenticated RCE vulnerabilities in Cisco ISE 3.3+ allow attackers to execute code as root; no wild exploitation yet.
Cisco Identity Services Engine (ISE) and ISE-PIC versions 3.3 and later contain two critical remote code execution vulnerabilities accessible to unauthenticated attackers. CVE-2025-20281 affects a public-facing API that insufficiently validates user input, allowing an attacker to submit a crafted request and obtain root privileges without authentication. CVE-2025-20282 targets an internal API lacking file validation, permitting an attacker to upload arbitrary files to privileged directories and execute them as root. Both vulnerabilities require no credentials and can be exploited via network access alone. Successful exploitation grants immediate root access to affected ISE systems, which manage secure network resource access across enterprises.
Cisco ISE is widely deployed in government and enterprise environments for identity and access control. The advisory indicates no active exploitation has been observed in the wild at this time, but the severity and ease of exploitation make rapid patching critical. Organizations should immediately apply Cisco's updates after testing and implement network segmentation to isolate ISE systems, enforce least-privilege access controls, and conduct vulnerability scans to identify affected instances.
Mentioned in this report
Detection guidance
Java Service Spawning Shell With Download or Reverse-Shell Commands on Linux
A Java-based application server spawning sh/bash with download, reverse-shell or decode-and-run arguments, typical of RCE against a public-facing Java API such as Cisco ISE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Service Spawning Shell With Download or Reverse-Shell Commands on Linux
description: Detects a Java process (for example the application server of an appliance
such as Cisco ISE) spawning a shell whose command line downloads content, opens
a reverse shell or decodes a payload. This is a generic post-exploitation pattern
after unauthenticated RCE in a public-facing Java API, not a CVE-specific indicator.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- mkfifo
- base64 -d
- nc -e
- ncat
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java-based deployment or build tools (for example Jenkins agents) that legitimately
run curl or wget in shell steps
- Application health-check scripts launched from a Java service that use curl against
localhost
level: medium
id: ca58b026-bb77-539b-80c8-1176a95471cf
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059
Java Process Spawning Binary Executed From World-Writable Directory on Linux
A Java process directly launching an executable from /tmp, /var/tmp or /dev/shm, consistent with an uploaded file being executed after exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Binary Executed From World-Writable Directory on Linux
description: Detects a Java parent process launching a child whose image resides in
/tmp, /var/tmp or /dev/shm. Matches the behaviour of an arbitrary file upload followed
by execution as a privileged user after exploiting an API flaw in a public-facing
Java application.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /java
Image|startswith:
- /tmp/
- /var/tmp/
- /dev/shm/
condition: selection
falsepositives:
- Java applications that unpack and run native helper binaries from a temp directory
at startup
- Software installers written in Java that execute extracted setup tools from /tmp
level: medium
id: db8bd432-50a8-5f85-8d61-7e1f54195f13
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs