Organizations using Cisco ISE and ISE-PIC products have until August 18, 2025, to implement necessary mitigations as mandated by CISA’s Known Exploited Vulnerabilities catalog. These vulnerabilities stem from insufficient validation of user-supplied input, a fundamental security flaw classified under Common Weakness Enumeration CWE-74, which addresses improper neutralization of special elements in output used by downstream components. This level of access allows threat actors to manipulate network policies, extract sensitive authentication data, and establish persistent backdoors within compromised systems. The vulnerabilities, tracked as CVE-2025-20281 and CVE-2025-20337, allow attackers to achieve remote code execution with root privileges on affected systems. These vulnerabilities are very serious because they allow someone without a password to access critical network infrastructure components from a distance. Attackers can leverage these flaws to bypass network segmentation controls, access restricted network segments, and potentially deploy ransomware or establish command-and-control channels within compromised environments. CISA’s inclusion of these vulnerabilities in the KEV catalog triggers mandatory compliance requirements under Binding Operational Directive (BOD) 22-01 for federal agencies and cloud service providers. CISA has issued an urgent warning regarding two critical injection vulnerabilities in Cisco’s Identity Services Engine (ISE) that threat actors are actively exploiting. Organizations must apply vendor-supplied mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of vulnerable products if patches are unavailable. The affected systems are commonly deployed in enterprise environments to manage user authentication, authorization, and accounting (AAA) services across network resources. CISA added two Cisco ISE vulnerabilities (CVE-2025-20281, CVE-2025-20337) to its Known Exploited Vulnerabilities catalog. Attackers can gain root access and execute remote code on Cisco ISE systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Jul 2025 06:05:15 +0000