Cisco Identity Services Stored Cross-Site Scripting Vulnerability

TL;DR 📌

• A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this…
• Highest CVSS: 4.8 (Medium).
• Fix available — see the first fixed release below.
• CVEs: CVE-2025-20267.

What it is

CVE-2025-20267 is a stored cross-site scripting flaw in the web-based management interface of Cisco Identity Services Engine (ISE). It stems from insufficient validation of user-supplied input in that interface.

To exploit it, an attacker needs valid administrative credentials — this is not an unauthenticated, remote-anywhere issue. With those credentials, the attacker injects malicious script into specific pages of the ISE admin interface. When another user of that interface views the affected page, the injected code runs in their browser session, in the context of the ISE management UI.

The practical impact is execution of arbitrary script in another admin’s browser session, or access to sensitive browser-based information (such as session tokens or data rendered in the interface). This sits entirely in the management plane — ISE’s data-plane authentication and policy functions are not described as affected.

Cisco states the vulnerability affects ISE regardless of device configuration, and there are no workarounds.

What to do

• Upgrade to the fixed release for your train: 3.3P5 for ISE 3.3, or 3.4P1 for ISE 3.4. For 3.2, the fix is 3.2P8, listed as a future release — check the advisory for its availability before planning a maintenance window.
• If you’re running ISE 3.1 or earlier, there is no fix in that train; Cisco’s guidance is to migrate to a fixed release.
• Since there’s no workaround, treat the upgrade as the only mitigation. In the meantime, limit and audit who holds administrative credentials on ISE, given that exploitation requires an authenticated admin session.
• Advise ISE administrators to be cautious with links or content pointed at the management interface from untrusted sources, as stored XSS payloads would execute in their authenticated session.

Fixed releases

For leadership 🧭

Executive summary. An attacker who already holds valid administrative credentials on Cisco ISE can plant script in the admin interface that hijacks another admin’s browser session when they view the affected page. There’s no workaround, so this needs a scheduled upgrade rather than emergency action, but admin access to ISE should be tightened in the meantime.

Why it matters:

• Affects the web-based management interface of Cisco ISE, the system many networks rely on for authentication and policy decisions, though the data plane itself is not affected
• Exploitation requires an existing authenticated admin session, meaning the real exposure is any account with excessive or poorly audited administrative access to ISE
• A successful attack runs arbitrary script in another admin’s browser inside the ISE management UI, potentially exposing session tokens or other browser-based data
• No workaround exists, and ISE 3.1 and earlier have no fix at all, only migration to a supported train

Now / Next / Later:

• Now: Review who currently holds administrative credentials on ISE and tighten that list, since exploitation depends entirely on an attacker already having authenticated admin access.
• Next: Upgrade to 3.3P5 (ISE 3.3) or 3.4P1 (ISE 3.4) in your next maintenance window; if on 3.2, check for 3.2P8’s release before scheduling, and if on 3.1 or earlier, plan a migration to a fixed train.
• Later: Establish routine review of ISE admin account provisioning and session hygiene, and caution ISE administrators against following untrusted links or content into the management interface, since stored XSS payloads execute in the viewer’s session.

Source

• Cisco advisory
• CVE-2025-20267 on NVD