CrowdSec Threat Intelligence has observed a new wave of targeted exploitation attempts centered around CVE-2025-20281. CVE-2025-20281 is a critical Remote Code Execution (RCE) vulnerability in Cisco Identity Services Engine (ISE). In this week’s threat alert, we dive into how this vulnerability works, how attackers exploit it, and why it might be seeing a resurgence this week.
Key findings
CVE-2025-20281 (CVSS 10.0) was published on June 25, 2025. CrowdSec released a detection rule on August 13, 2025, to identify and block exploitation attempts. A fresh spike of exploitation was observed starting February 23, 2026.
CVE-2025-20281 originates from an insufficient validation process in the REST API of Cisco ISE. It allows attackers to run arbitrary commands with root permission levels.
While the initial attacks during the first week of the vulnerabilities were a healthy mix of targeted and opportunistic, the recent surge is mainly driven by opportunistic actors using CVE-2025-20281 in their exploit kits.
