PT-2025-26846 · Cisco · Cisco Identity Services Engine

Jesse Via · Published 2025-06-25 · Updated 2025-06-26 · CVE-2025-20264

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) (affected versions not specified)

Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This is due to insufficient authorization enforcement mechanisms for users created by SAML SSO integration with an external identity provider. An attacker could exploit this vulnerability by submitting a series of specific commands to an affected device, potentially modifying a limited number of system settings, including some that would result in a system restart. In single-node Cisco ISE deployments, devices that are not authenticated to the network will not be able to authenticate until the Cisco ISE system comes back online.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-20264

Affected Products

Cisco Identity Services Engine

References · 7

• https://osv.dev/vulnerability/CVE-2025-20264 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-mVfKVQAU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20264 · Security Note
• https://t.me/true_secator/7172 · Telegram Post
• https://t.me/cvenotify/126654 · Telegram Post
• https://twitter.com/CVEnew/status/1937916422467788837 · Twitter Post
• https://twitter.com/transilienceai/status/1938030862911590407 · Twitter Post