Cisco warns that recently patched critical vulnerabilities in Cisco Identity Services Engine (ISE) are being exploited in active attacks. Immediate software updates are essential to prevent unauthorized remote code execution and potential network compromise. #CiscoISE #RCEVulnerabilities
Keypoints
- Three critical remote code execution vulnerabilities in Cisco ISE are actively exploited in the wild.
- Exploits allow attackers to execute arbitrary commands and upload malicious files without authentication.
- Vulnerabilities include CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337, all rated at maximum severity (CVSS 10.0).
- Network administrators are advised to update ISE to specific patches: Patch 7 for 3.3 and Patch 2 for 3.4.
- No workarounds exist, making prompt application of security updates critical for protection.