CVE-2025-20286 is a critical (9.9) flaw in Cisco Identity Services Engine deployed on AWS, Azure and OCI. Credentials are generated so that different deployments share them. Cisco has released a hot fix and fixed releases. Apply them, and restrict who can reach the instance in the meantime.
What's affected
Cisco's advisory, first published 4 June 2025, lists these vulnerable releases of Cisco ISE in the default configuration. On AWS, releases 3.1, 3.2, 3.3 and 3.4. On Azure and Oracle Cloud Infrastructure, releases 3.2, 3.3 and 3.4. If the Primary Administration node is in the cloud, ISE is affected. If it is on premises, it is not.
Cisco lists these as not affected. On premises deployments installed from the ISO or OVA from the Cisco Software Download Center, ISE on Azure VMware Solution, ISE on Google Cloud VMware Engine, ISE on VMware cloud in AWS, and hybrid deployments with all Administration personas on premises. Release 3.0 and earlier is also not affected.
The weakness is CWE-259, use of a hard-coded password. The credentials are specific to each release and platform. All instances of release 3.1 on AWS share one set, and release 3.2 on AWS does not share with release 3.2 on Azure. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Cisco says it is aware of proof of concept exploit code and is not aware of malicious use. The record is not on the CISA Known Exploited Vulnerabilities list.
Fixed versions: from Cisco's table, a hot fix named ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz applies to releases 3.1 through 3.4. First fixed releases are 3.3P8 for release 3.3 and 3.4P3 for release 3.4. Releases 3.1 and 3.2 are told to migrate to a fixed release. The table also lists a planned release 3.5.
How to check if you're exposed
- In your cloud accounts on AWS, Azure and OCI, find every Cisco ISE instance created from the cloud marketplace images.
- Note the release and patch level of each.
- Find where the Primary Administration persona runs. If it is in the cloud, treat the deployment as affected.
- Compare the release to the table above, and check whether the hot fix or a fixed patch level is installed.
- Check the network rules on each instance. The advisory describes access through unsecured ports, so see which source addresses can reach them.
What to do now
- Install the Cisco hot fix on releases 3.1 through 3.4 that run in the cloud, or upgrade to a fixed patch level.
- Until then, use the mitigations Cisco gives. Allow only the source IPs of your administrators in the cloud security groups. Also allow only those source IPs inside the ISE UI.
- For fresh installations, Cisco says to run the command application reset-config ise on the Primary Administration persona node in the cloud, to set new passwords. Secondary nodes do not need it. Read the warning first. The command resets ISE to factory configuration.
- Take a new configuration backup after the fix. Cisco warns that restoring a backup taken before the fix brings back the old credentials. If an old backup was restored, remove and reinstall the hot fix.
- Review access logs and cloud audit logs for unfamiliar sign ins and changes.
- Rotate any secrets stored in or shared with ISE if you find signs of misuse.
Why it matters
Shared credentials break the basic idea that each system has its own secrets. Anyone who obtains the credentials from one deployment, by extracting them from an instance they can legitimately use, holds a working key for every other deployment of the same release on the same platform. That is why the score is 9.9 and why scope is marked as changed in the vector.
ISE sits in the middle of network access control, deciding who and what is allowed onto the network. A flaw in that system is a flaw in the gatekeeper. Treat it as a priority, and note how little the mitigation needs. Limiting source addresses is quick and shrinks the exposure while you plan the patch.
Quick check
My Primary Administration node is on premises. Am I affected?
According to the advisory, no. If the Primary Administration persona is deployed in the cloud, ISE is affected. On premises primary nodes are not.
Why does Cisco warn about restoring a backup?
A backup taken before the fix holds the old credentials. Restoring it brings them back. Take a new backup after installing the fix, and reinstall the hot fix if an old backup was restored.
Sources
Last reviewed: 19 October 2026.
