CVE-2025-20286

A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

• CWE-259

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7Vendor Advisory

Published

Jun 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20280A vulnerability in the web-based management interface of Cis…4.8
• CVE-2025-20281A vulnerability in a specific API of Cisco ISE and Cisco ISE…10
• CVE-2025-20282A vulnerability in an internal API of Cisco ISE and Cisco IS…10
• CVE-2025-20283A vulnerability in a specific API of Cisco ISE and Cisco ISE…7.2
• CVE-2025-20284A vulnerability in a specific API of Cisco ISE and Cisco ISE…7.2
• CVE-2025-20285A vulnerability in the IP Access Restriction feature of Cisc…4.1
• CVE-2025-20287A vulnerability in the web-based management interface of Cis…8.8
• CVE-2025-20288A vulnerability in the web-based management interface of Cis…5.3
• CVE-2025-20289Multiple vulnerabilities in the web-based management interfa…5.4
• CVE-2025-2029A vulnerability was found in MicroDicom DICOM Viewer 2025.1 …5.3
• CVE-2025-20290A vulnerability in the logging feature of Cisco NX-OS Softwa…5.5
• CVE-2025-20291A vulnerability in Cisco Webex Meetings could have allowed a…6.1