Advisories · Technology

Cisco Identity Services Engine Software.

Every CVE that names Cisco Identity Services Engine Software among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-20303 CVE record

CVSS 5.4 Medium

Cross-site scripting in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2025
CVE-2025-20343 CVE record

CVSS 8.6 High

Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability
- Cisco Identity Services Engine Software
- CWE-697
Not analysed yet 5 Nov 2025
CVE-2025-20131 CVE record

CVSS 4.9 Medium

Cisco Identity Services Engine Arbitrary File Upload Vulnerability
- Cisco Identity Services Engine Software
- Broken access control
Not analysed yet 20 Aug 2025
CVE-2025-20332 CVE record

CVSS 4.3 Medium

Cisco Identity Services Engine Authorization Bypass Vulnerability
- Cisco Identity Services Engine Software
- Broken access control
Not analysed yet 6 Aug 2025
CVE-2025-20331 CVE record

CVSS 5.4 Medium

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2025
CVE-2025-20337 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Other injection
Not analysed yet 16 Jul 2025
CVE-2025-20285 CVE record

CVSS 4.1 Medium

Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability
- Cisco Identity Services Engine Software
- CWE-302
Not analysed yet 16 Jul 2025
CVE-2025-20284 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Other injection
Not analysed yet 16 Jul 2025
CVE-2025-20283 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Other injection
Not analysed yet 16 Jul 2025
CVE-2025-20282 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Privilege escalation
Not analysed yet 25 Jun 2025
CVE-2025-20281 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Other injection
Not analysed yet 25 Jun 2025
CVE-2025-20264 CVE record

CVSS 6.4 Medium

Cisco Identity Services Engine Authorization Bypass Vulnerability
- Cisco Identity Services Engine Software
- Broken access control
Not analysed yet 25 Jun 2025
CVE-2025-20286 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ISE on AWS Static Credential
- Cisco Identity Services Engine Software
- Hard-coded credentials
Not analysed yet 4 Jun 2025
CVE-2025-20130 CVE record

CVSS 4.9 Medium

Cisco Identity Services Engine Access Control Bypass Vulnerability
- Cisco Identity Services Engine Software
- Broken access control
Not analysed yet 4 Jun 2025
CVE-2025-20267 CVE record

CVSS 4.8 Medium

Cisco Identity Services Stored Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 21 May 2025
CVE-2025-20152 CVE record

CVSS 8.6 High

ISE restart
- Cisco Identity Services Engine Software
- Memory corruption
Not analysed yet 21 May 2025
CVE-2025-20205 CVE record

CVSS 4.8 Medium

Cross-site scripting in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2025
CVE-2025-20204 CVE record

CVSS 4.8 Medium

Cross-site scripting in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2025
CVE-2025-20125 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Broken access control
Not analysed yet 5 Feb 2025
CVE-2025-20124 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Cisco Identity Services Engine Java Deserialization Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Insecure deserialization
Not analysed yet 5 Feb 2025
CVE-2020-3525 CVE record

CVSS 4.3 Medium

Cisco Identity Services Engine Password Disclosure to an Unauthorized Actor Vulnerability
- Cisco Identity Services Engine Software
- Information disclosure
Not analysed yet 18 Nov 2024
CVE-2024-20539 CVE record

CVSS 4.8 Medium

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2024
CVE-2024-20538 CVE record

CVSS 6.1 Medium

Cisco Identity Services Engine Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2024
CVE-2024-20537 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Authorization Bypass Vulnerability
- Cisco Identity Services Engine Software
- Broken access control
Not analysed yet 6 Nov 2024
CVE-2024-20532 CVE record

CVSS 5.5 Medium

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability
- Cisco Identity Services Engine Software
- Path traversal
Not analysed yet 6 Nov 2024
CVE-2024-20531 CVE record

CVSS 5.5 Medium

Cisco Identity Services Engine XML External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- XML external entities (XXE)
Not analysed yet 6 Nov 2024
CVE-2024-20530 CVE record

CVSS 6.1 Medium

Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2024
CVE-2024-20529 CVE record

CVSS 5.5 Medium

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability
- Cisco Identity Services Engine Software
- Path traversal
Not analysed yet 6 Nov 2024
CVE-2024-20528 CVE record

CVSS 3.8 Low

Cisco Identity Services Engine Path Traversal Vulnerability
- Cisco Identity Services Engine Software
- Path traversal
Not analysed yet 6 Nov 2024
CVE-2024-20527 CVE record

CVSS 5.5 Medium

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability
- Cisco Identity Services Engine Software
- Path traversal
Not analysed yet 6 Nov 2024
CVE-2024-20525 CVE record

CVSS 6.1 Medium

Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2024
CVE-2024-20487 CVE record

CVSS 4.3 Medium

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2024
CVE-2024-20476 CVE record

CVSS 4.3 Medium

Cisco Identity Services Engine Authorization Bypass Vulnerability
- Cisco Identity Services Engine Software
- CWE-602
Not analysed yet 6 Nov 2024
CVE-2024-20515 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Information Disclosure Vulnerability
- Cisco Identity Services Engine Software
- Weak cryptography or TLS
Not analysed yet 2 Oct 2024
CVE-2024-20469 CVE record

CVSS 6.0 Medium

Cisco Identity Services Engine Command Injection Vulnerability
- Cisco Identity Services Engine Software
- Command injection
Not analysed yet 4 Sept 2024
CVE-2024-20417 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities
- Cisco Identity Services Engine Software
- SQL injection
Not analysed yet 21 Aug 2024
CVE-2024-20466 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability
- Cisco Identity Services Engine Software
- Privilege escalation
- Broken access control
Not analysed yet 21 Aug 2024
CVE-2024-20486 CVE record

CVSS 6.5 Medium

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability
- Cisco Identity Services Engine Software
- Cross-site request forgery (CSRF)
Not analysed yet 21 Aug 2024
CVE-2024-20479 CVE record

CVSS 4.8 Medium

Cross-site scripting in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 7 Aug 2024
CVE-2024-20443 CVE record

CVSS 5.4 Medium

Cross-site scripting in Cisco Adaptive Security Appliance (ASA) Software and others
- Cisco Adaptive Security Appliance (ASA) Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 7 Aug 2024
CVE-2024-20296 CVE record

CVSS 4.7 Medium

Unrestricted file upload in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Unrestricted file upload
Not analysed yet 17 Jul 2024
CVE-2024-20368 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site request forgery (CSRF)
Not analysed yet 3 Apr 2024
CVE-2024-20332 CVE record

CVSS 5.5 Medium

Server-side request forgery in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Server-side request forgery (SSRF)
Not analysed yet 3 Apr 2024
CVE-2024-20251 CVE record

CVSS 4.8 Medium

Cross-site scripting in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 17 Jan 2024
CVE-2023-20272 CVE record

CVSS 6.7 Medium

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application.
- Cisco Identity Services Engine Software
- CWE-424
Not analysed yet 21 Nov 2023
CVE-2023-20208 CVE record

CVSS 4.8 Medium

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an af…
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
Not analysed yet 21 Nov 2023
CVE-2023-20175 CVE record

CVSS 8.8 High

OS command injection in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Command injection
Not analysed yet 1 Nov 2023
CVE-2023-20170 CVE record

CVSS 6.0 Medium

Command injection in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Command injection
Not analysed yet 1 Nov 2023
CVE-2023-20196 CVE record

CVSS 4.7 Medium

Unrestricted file upload in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Unrestricted file upload
Not analysed yet 1 Nov 2023
CVE-2023-20195 CVE record

CVSS 4.7 Medium

Unrestricted file upload in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Unrestricted file upload
Not analysed yet 1 Nov 2023
CVE-2023-20213 CVE record

CVSS 4.3 Medium

Out-of-bounds write in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Memory corruption
Not analysed yet 1 Nov 2023
CVE-2023-20194 CVE record

CVSS 4.9 Medium

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device.
- Cisco Identity Services Engine Software
- Privilege escalation
Not analysed yet 7 Sept 2023
CVE-2023-20193 CVE record

CVSS 6.0 Medium

OS command injection in Cisco Identity Services Engine Software
- Cisco Identity Services Engine Software
- Command injection
Not analysed yet 7 Sept 2023
CVE-2023-20243 CVE record

CVSS 8.6 High

A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS…
- Cisco Identity Services Engine Software
- CWE-399
Not analysed yet 6 Sept 2023
CVE-2023-20111 CVE record

CVSS 6.5 Medium

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information.
- Cisco Identity Services Engine Software
- Information disclosure
Not analysed yet 16 Aug 2023
CVE-2023-20228 CVE record

CVSS 6.1 Medium

Cross-site scripting in Cisco Identity Services Engine Software and others
- Cisco Identity Services Engine Software
- Cisco Unified Computing System (Standalone)
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2023
CVE-2023-20174 CVE record

CVSS 4.9 Medium

Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
- Cisco Identity Services Engine Software
- XML external entities (XXE)
Not analysed yet 18 May 2023
CVE-2023-20173 CVE record

CVSS 4.9 Medium

Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
- Cisco Identity Services Engine Software
- XML external entities (XXE)
Not analysed yet 18 May 2023
CVE-2023-20172 CVE record

CVSS 5.4 Medium

Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
- Cisco Identity Services Engine Software
- CWE-602
Not analysed yet 18 May 2023
CVE-2023-20171 CVE record

CVSS 5.4 Medium

Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
- Cisco Identity Services Engine Software
- CWE-602
Not analysed yet 18 May 2023