Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

Cisco ISE - Remote Code Execution

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

CVE-2025-20281-2-Cisco-ISE-RCE

CVE-2025-20281-2-Cisco-ISE-RCE Cisco ISE API に対する CVE-2025-20281 RCE の未認証 Python PoC CVE-2025-20281 未認証 PoC Cisco ISE の ERS API CVE-2025-20281 における未認証 RCE を悪用し、InternalUser リソースに任意のシェルコマンドを注入する、最小限の Python プルーフオブコンセプトです。 警告: 自分が所有するシステム、または明示的なテスト許可があるシステムに対してのみ実行してください。このツールの不正使用は違法です。 機能 認証不要...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 概念実証 解説: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ このPythonスクリプトは、/admin/files-upload/ で認証なしに利用可能なアップロード機能を悪用します。 スクリプトはローカルに bin フォルダと isehourlycron.sh というファイルを作成し、Cisco ISE インストール環境の /opt/CSMS/bin...

Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API 未認証RCEエクスプロイト このリポジトリには、CVE-2025-20281 の Python 3 概念実証エクスプロイトが含まれています。この脆弱性は Cisco Identity Services Engine ISE に存在し、ERS API を介して ルート権限による未認証リモートコード実行 RCE を可能にします。 🩻 脆弱性の概要 Cisco ISE ERS の /ers/sdk エンドポイントは、ユーザー作成リクエストを処理する際に認証を検証しません。 攻撃者は InternalUser オブジェクトの...

CVE-2025-20281-Cisco

CVE-2025-20281 - Cisco ISE RCE 脆弱性チェッカー このスクリプトは、Cisco Identity Services Engine ISE および ISE-PIC に CVE-2025-20281 脆弱性が存在するかどうかをチェックします。この脆弱性は、特定の API における入力検証の不備により、認証不要のリモートコード実行 RCE を root 権限で可能にするものです。 このツールは、許可されたセキュリティテストおよび教育目的のみで使用することを意図しています。所有していない、またはテストの許可を得ていないシステムに対して使用しないでください。...

CVE-2026-20180

Cisco ISE RCE: 高度な悪用分析と修復 📋 目次 1. エグゼクティブサマリー 2. 攻撃対象領域の分析 3. 悪用ベクトル 4. 高度な回避技術 5. ゼロトラストアーキテクチャへのシステム的影響 6. 修復戦略 7. フォレンジック調査 8. 参考文献 🎯 エグゼクティブサマリー Cisco Identity Services Engine ISE...

Blackash-CVE-2025-20343

🔒 CVE-2025-20343: Cisco ISE RADIUS抑制 DoS脆弱性 🌐 ⚠️ 概要 🚨 Cisco Identity Services Engine ISE における高深刻度 のサービス拒否 DoS 脆弱性！ 💥 認証されていないリモート攻撃者 が、細工したRADIUSパケットでデバイスをクラッシュ させる可能性があります。 📅 公開日 : 2025年11月5日 ✅ 実環境での悪用は確認されていません （今のところ） 🛠️ 仕組み 🔄 「Reject RADIUS requests from clients with repeated failures」...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multiauth-bypass-sgD2HbL4)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. CVE-2026-76446 - A...

Cisco Identity Services Engine (cisco-sa-ise-multiauth-bypass-sgD2HbL4)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. CVE-2026-76444 - A...

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks

A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost...

Cisco Identity Services Engine (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web...

Cisco Identity Services Engine (cisco-sa-ISE-ABP-VNSW7Tn5)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. CVE-2026-76460 Please see the included Cisco BIDs and Cisco Security Adviso...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

Cisco Identity Services Engine (cisco-sa-ise-RADIUS-dos-wR3hYPMw)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is d...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine ISE that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 CVSS score: 10.0, could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability i...