# Cisco ISE remote code execution flaws require immediate patching

Published: 2026-06-09 · Severity: high · Sectors: government-national, defense, financial-services, healthcare, education, technology
Canonical: https://vorant.io/reports/02731d80-3839-5b4b-a710-1a6824e4634c/cisco-ise-remote-code-execution-flaws-require-immediate-patching

> Two unauthenticated RCE vulnerabilities in Cisco ISE 3.3+ allow attackers to execute code as root; no wild exploitation yet.

Cisco Identity Services Engine (ISE) and ISE-PIC versions 3.3 and later contain two critical remote code execution vulnerabilities accessible to unauthenticated attackers. CVE-2025-20281 affects a public-facing API that insufficiently validates user input, allowing an attacker to submit a crafted request and obtain root privileges without authentication. CVE-2025-20282 targets an internal API lacking file validation, permitting an attacker to upload arbitrary files to privileged directories and execute them as root. Both vulnerabilities require no credentials and can be exploited via network access alone. Successful exploitation grants immediate root access to affected ISE systems, which manage secure network resource access across enterprises.

Cisco ISE is widely deployed in government and enterprise environments for identity and access control. The advisory indicates no active exploitation has been observed in the wild at this time, but the severity and ease of exploitation make rapid patching critical. Organizations should immediately apply Cisco's updates after testing and implement network segmentation to isolate ISE systems, enforce least-privilege access controls, and conduct vulnerability scans to identify affected instances.

## Mentioned in this report

- Vulnerabilities: CVE-2025-20281 (KEV), CVE-2025-20282 (templated)

## Detection guidance (public sample)

### Java Service Spawning Shell With Download or Reverse-Shell Commands on Linux

ATT&CK: T1190

A Java-based application server spawning sh/bash with download, reverse-shell or decode-and-run arguments, typical of RCE against a public-facing Java API such as Cisco ISE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Service Spawning Shell With Download or Reverse-Shell Commands on Linux
description: Detects a Java process (for example the application server of an appliance
  such as Cisco ISE) spawning a shell whose command line downloads content, opens
  a reverse shell or decodes a payload. This is a generic post-exploitation pattern
  after unauthenticated RCE in a public-facing Java API, not a CVE-specific indicator.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - mkfifo
    - base64 -d
    - nc -e
    - ncat
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java-based deployment or build tools (for example Jenkins agents) that legitimately
  run curl or wget in shell steps
- Application health-check scripts launched from a Java service that use curl against
  localhost
level: medium
id: ca58b026-bb77-539b-80c8-1176a95471cf
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059
```

### Java Process Spawning Binary Executed From World-Writable Directory on Linux

ATT&CK: T1190

A Java process directly launching an executable from /tmp, /var/tmp or /dev/shm, consistent with an uploaded file being executed after exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Binary Executed From World-Writable Directory on Linux
description: Detects a Java parent process launching a child whose image resides in
  /tmp, /var/tmp or /dev/shm. Matches the behaviour of an arbitrary file upload followed
  by execution as a privileged user after exploiting an API flaw in a public-facing
  Java application.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    Image|startswith:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
  condition: selection
falsepositives:
- Java applications that unpack and run native helper binaries from a temp directory
  at startup
- Software installers written in Java that execute extracted setup tools from /tmp
level: medium
id: db8bd432-50a8-5f85-8d61-7e1f54195f13
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-ise-and-ise-pic-could-allow-for-remote-code-execution_2025-059

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/02731d80-3839-5b4b-a710-1a6824e4634c/cisco-ise-remote-code-execution-flaws-require-immediate-patching.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup