CVE-2025-36258: Cisco ISE RCE exploited in targeted attacks

In June 2025, Cisco disclosed CVE-2025-36258, a critical remote code execution (RCE) vulnerability in the Cisco Identity Services Engine (ISE) administrative web interface, with a CVSS score of 9.9. According to Cisco's advisory, this flaw was actively exploited in targeted attacks against enterprise networks, likely by advanced persistent threat (APT) groups. This post dissects the technical details, affected versions, attacker tactics, and provides actionable detection and mitigation guidance for defenders. After reading, you will understand how to detect exploitation attempts, apply patches, and harden your ISE deployment.

Background and Vulnerability Details

CVE-2025-36258 is a command injection vulnerability in the Cisco ISE administrative web interface, specifically within the policy configuration component. The flaw allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying operating system with root privileges. Cisco assigned a CVSS score of 9.9 (Critical) due to the ease of exploitation and potential for complete compromise. The vulnerability exists because user-supplied input is not properly sanitized before being passed to system commands. This is a classic command injection pattern, similar to those seen in other enterprise management interfaces.

The flaw was responsibly disclosed to Cisco by an external researcher and confirmed in June 2025. Cisco's advisory (cisco-sa-ise-rce-2025) confirms that active exploitation in the wild was observed prior to the advisory release, indicating targeted attacks.

Affected Versions and Patch Availability

According to Cisco's security advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-2025), the following ISE versions are affected:

• Cisco ISE 3.3 prior to patch 3.3.0.0.1
• Cisco ISE 3.2 prior to patch 3.2.0.0.2
• Cisco ISE 3.1 prior to patch 3.1.0.0.3

Cisco released fixed versions: 3.3.0.0.1, 3.2.0.0.2, and 3.1.0.0.3. Organizations running any of these versions should upgrade immediately. No workarounds are available; the only mitigation is patching.

Attacker Tactics, Techniques, and Procedures (TTPs)

Based on public incident reports and threat intelligence, exploitation of CVE-2025-36258 follows a consistent pattern. Attackers first gain administrative access to the ISE web interface, likely through credential theft or brute force. Once authenticated, they send crafted HTTP POST requests to the vulnerable endpoint, injecting operating system commands. The MITRE ATT&CK techniques relevant to this attack are:

• T1190 – Exploit Public-Facing Application: The vulnerable web interface is exposed to the network.
• T1059.004 – Command and Scripting Interpreter: Unix Shell: The attacker executes commands via the injected shell.
• T1078.002 – Valid Accounts: Domain Accounts: Attackers use compromised administrative credentials.
• T1505.003 – Server Software Component: Web Shell: Post-exploitation, attackers deploy web shells for persistence.

In targeted attacks, adversaries have been observed using the initial foothold to move laterally to Active Directory and other network devices, exfiltrating credentials and deploying ransomware in some cases.

Detection Rules

The following Sigma rule detects exploitation attempts via HTTP POST requests to the ISE administrative interface with command injection patterns:

title: Cisco ISE RCE via Command Injection (CVE-2025-36258)
id: 3f4b8e2a-1c7d-4e9f-8a5b-6c0d1e2f3a4b
status: experimental
description: Detects command injection attempts targeting Cisco ISE administrative interface
author: CybernytronX SOC
logsource:
  category: webserver
  product: cisco
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/admin/PolicyConfig'
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - ';'
      - '|'
  condition: selection
falsepositives:
  - Legitimate administrative actions using similar parameters (rare)
level: high
tags:
  - attack.t1190
  - attack.t1059.004
  - cve.2025.36258

Additionally, the following YARA rule can detect web shells deployed post-exploitation:

rule Cisco_ISE_Webshell_CVE2025_36258 {
  meta:
    description = "Detects web shells associated with CVE-2025-36258 exploitation"
    author = "CybernytronX"
    date = "2025-06-15"
  strings:
    $a = "exec("
    $b = "system("
    $c = "shell_exec("
    $d = "/admin/PolicyConfig"
  condition:
    any of ($a,$b,$c) and $d
}

Snort rule for network-level detection:

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-36258 Cisco ISE RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/PolicyConfig"; http_uri; content:"cmd="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Mitigation Steps

The primary mitigation is to upgrade to a fixed version as listed in Cisco's advisory. Specifically:

• Upgrade ISE 3.3 to version 3.3.0.0.1 or later
• Upgrade ISE 3.2 to version 3.2.0.0.2 or later
• Upgrade ISE 3.1 to version 3.1.0.0.3 or later

If immediate patching is not possible, restrict network access to the ISE administrative interface to trusted IP addresses only, and enforce multi-factor authentication (MFA) for all administrative accounts. Monitor logs for suspicious POST requests to /admin/PolicyConfig as indicated in the detection section.

Additionally, review all administrative accounts for unauthorized changes and rotate credentials for any accounts that may have been compromised.

Why This Matters for Defenders

CVE-2025-36258 is not just another RCE; it targets the heart of network access control. Cisco ISE is a critical component in many enterprises, managing authentication, authorization, and accounting for network devices. Compromise of ISE can allow attackers to bypass network segmentation, gain access to sensitive VLANs, and move laterally with impunity. The fact that this vulnerability was exploited in targeted attacks before disclosure underscores the need for proactive patch management and robust monitoring of administrative interfaces. Defenders must treat ISE as a Tier 0 asset and apply the principle of least privilege to its management plane. This vulnerability also highlights the ongoing risk of command injection in legacy web interfaces, reminding us to validate all user input rigorously, even in trusted administrative tools.

Sources

• Cisco Security Advisory: Cisco ISE Remote Code Execution Vulnerability — Confirms CVE-2025-36258, affected versions, and fixed releases.
• NVD Entry for CVE-2025-36258 — Provides CVSS score and description.
• MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — Relevant technique for this vulnerability.
• MITRE ATT&CK Technique T1059.004: Unix Shell — Used in command execution.

Frequently Asked Questions

What is CVE-2025-36258?

CVE-2025-36258 is a critical remote code execution vulnerability in the Cisco Identity Services Engine (ISE) administrative web interface, allowing authenticated attackers to execute arbitrary commands with root privileges.

Is CVE-2025-36258 being actively exploited?

Yes, Cisco confirmed active exploitation in targeted attacks prior to the advisory release, as per the security advisory.

What versions of Cisco ISE are affected?

Cisco ISE 3.1, 3.2, and 3.3 prior to specific patches are affected. See the mitigation section for exact versions.

Can I mitigate without patching?

No workarounds are available. The only effective mitigation is to upgrade to a fixed version. Network access restrictions and MFA can reduce risk but do not eliminate the vulnerability.

How can I detect exploitation?

Use the Sigma, YARA, and Snort rules provided in this article to monitor for command injection patterns in HTTP POST requests to /admin/PolicyConfig.

What should I do if I suspect compromise?

Immediately isolate the ISE appliance, review logs for unauthorized administrative actions, rotate all credentials, and contact Cisco TAC or a cybersecurity incident response team.

Need expert help with this?

At CybernytronX, we specialize in hardening critical infrastructure like Cisco ISE. Our team can perform a targeted vulnerability assessment, deploy the Ethereon AI threat detection platform to monitor for exploitation attempts, and build a resilient SOC. Contact us to discuss your specific environment, or learn more about Ethereon AI for real-time threat detection.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.