CVE-2025-20286: PoC Available for Critical Cisco Identity Services Engine Static Credential Vulnerability

On June 4, 2025, Cisco released fixes for multiple vulnerabilities, several of which were noted to have publicly available proof-of-concept (PoC) exploit code. The most severe issue, CVE-2025-20286, affects cloud deployments of Cisco Identity Services Engine (ISE) on Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI). When exploited, it could allow an unauthenticated, remote threat actor to access sensitive data, execute certain administrative operations, modify system configurations, or disrupt services within the impacted systems. 

CVE-2025-20286 arises from improperly generated credentials during cloud deployment, causing identical credentials to be shared across different Cisco ISE instances running the same platform and software release. The vulnerability is exploitable only if the Primary Administration Node is deployed in the cloud; on-premises deployments are not affected. 

Cisco ISE is a widely used network access control solution that manages identity and policy enforcement across enterprise networks. 

In addition to CVE-2025-20286, Cisco disclosed two medium severity vulnerabilities, both of which have publicly available PoC exploit code: 

• CVE-2025-20130: An arbitrary file upload vulnerability in Cisco ISE. 

• CVE-2025-20129: An information disclosure vulnerability in the Cisco Customer Collaboration Platform (formerly Cisco SocialMiner). 

Arctic Wolf has not observed exploitation of these vulnerabilities. However, due to the public availability of PoC exploit code and the historical targeting of Cisco products (as evidenced in CISA’s Known Exploited Vulnerabilities catalog), threat actors may attempt to exploit these vulnerabilities in the future. 

Recommendation For CVE-2025-20286

Upgrade to Latest Fixed Release

Arctic Wolf strongly recommends that customers upgrade to the latest fixed release of the products listed below. 

Please follow your organization’s patching and testing guidelines to minimize potential operational impact. 

• Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by CVE-2025-20286. If the Primary Administration node is on-premises, then it is not affected. 

References 

• Cisco Security Advisory (CVE-2025-20286)

• Cisco Security Advisory (CVE-2025-20130)

• Cisco Security Advisory (CVE-2025-20129)

Resources

Understand the threat landscape, and how to better defend your organization, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilizes threat intelligence to harden your attack surface and stop threats earlier and faster