CVE-2025-20264

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms for users created by SAML SSO integration with an external identity provider. An attacker could exploit this vulnerability by submitting a series of specific commands to an affected device. A successful exploit could allow the attacker to modify a limited number of system settings, including some that would result in a system restart. In single-node Cisco ISE deployments, devices that are not authenticated to the network will not be able to authenticate until the Cisco ISE system comes back online. 

• CWE-285

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-mVfKVQAUVendor Advisory

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20259Multiple vulnerabilities in the update process of Cisco Thou…5.3
• CVE-2025-2026The NPort 6100-G2/6200-G2 Series is affected by a high-sever…7.1
• CVE-2025-20260A vulnerability in the PDF scanning processes of ClamAV coul…9.8
• CVE-2025-20261A vulnerability in the SSH connection handling of Cisco Inte…8.8
• CVE-2025-20262A vulnerability in the Protocol Independent Multicast Versio…5
• CVE-2025-20263A vulnerability in the web services interface of Cisco Secur…8.6
• CVE-2025-20265A vulnerability in the RADIUS subsystem implementation of Ci…10
• CVE-2025-20267A vulnerability in the web-based management interface of Cis…4.8
• CVE-2025-20268A vulnerability in the Geolocation-Based Remote Access (RA) …5.8
• CVE-2025-20269A vulnerability in the web-based management interface of Cis…6.5
• CVE-2025-2027A double free vulnerability has been identified in the ASUS …5.9
• CVE-2025-20270A vulnerability in the web-based management interface of Cis…6.5