CVE-2025-20124

Cisco Identity Services Engine Java Deserialization Vulnerability

State: Published
Severity: 9.9 Critical
Published: Feb 5, 2025
Updated: Feb 26, 2026
Reserved: Oct 10, 2024

Description

A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.

This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges. Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H	cisco

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Cisco Identity Services Engine SoftwareCisco	3.0.0Affected 3.0.0 p1Affected 3.0.0 p2Affected 3.0.0 p3Affected 3.1.0Affected 3.0.0 p4Affected 3.1.0 p1Affected 3.0.0 p5Affected 3.1.0 p3Affected 3.1.0 p2Affected 3.0.0 p6Affected 3.2.0Affected 3.1.0 p4Affected 2.7.0 p8Affected 3.1.0 p5Affected 3.2.0 p1Affected 3.0.0 p7Affected 3.1.0 p6Affected 3.2.0 p2Affected 3.1.0 p7Affected 3.3.0Affected 3.2.0 p3Affected 3.0.0 p8Affected 3.2.0 p4Affected 3.1.0 p8Affected and 6 more versions
Cisco ISE Passive Identity ConnectorCisco	3.0.0Affected 3.2.0Affected 3.1.0Affected 3.3.0Affected

Product

Versions

Cisco Identity Services Engine SoftwareCisco

3.0.0Affected
3.0.0 p1Affected
3.0.0 p2Affected
3.0.0 p3Affected
3.1.0Affected
3.0.0 p4Affected
3.1.0 p1Affected
3.0.0 p5Affected
3.1.0 p3Affected
3.1.0 p2Affected
3.0.0 p6Affected
3.2.0Affected
3.1.0 p4Affected
2.7.0 p8Affected
3.1.0 p5Affected
3.2.0 p1Affected
3.0.0 p7Affected
3.1.0 p6Affected
3.2.0 p2Affected
3.1.0 p7Affected
3.3.0Affected
3.2.0 p3Affected
3.0.0 p8Affected
3.2.0 p4Affected
3.1.0 p8Affected
and 6 more versions

Cisco ISE Passive Identity ConnectorCisco

3.0.0Affected
3.2.0Affected
3.1.0Affected
3.3.0Affected

References

cisco-sa-ise-multivuls-FTW9AOXF

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.