Is CVE-2025-20281 being actively exploited?

Yes. CVE-2025-20281 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on July 28, 2025.

What is the CVSS score for CVE-2025-20281?

CVE-2025-20281 has a CVSS 3.1 base score of 10.0 (CRITICAL).

CVE-2025-20281

CRITICAL · CVSS 10.0CISA KEV: actively exploitedEPSS 97.6%EU EUVD: exploited

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Key facts

CVSS score: 10.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-74
EPSS score: 97.6% (100th percentile)
In CISA KEV: Yes, added July 28, 2025
In EU EUVD: Yes (EUVD-2025-19167)
Published: June 25, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco Identity Services Engine Injection Vulnerability

Added to the KEV catalog on July 28, 2025; federal remediation due August 18, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-19167 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector
cisco / identity services engine passive identity connector

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Cisco Identity Services Engine (ISE) V3.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11517-2025 - active

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281(US Government Resource)
https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability(Exploit, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain