Insufficient Authorization in Cisco Identity Services Engine Management Interface

CVE-2025-20264

What is CVE-2025-20264?

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) allows authenticated remote attackers to bypass authorization mechanisms for certain administrative functions. This issue arises from weak enforcement of authorization for users created via SAML SSO integration with an external identity provider. Attackers exploiting this flaw can issue specific commands to modify system settings potentially leading to a system restart. In isolated Cisco ISE deployments, devices lacking network authentication will remain unable to connect until the system is restored.

References