CVE-2025-36258: Critical RCE in Cisco ISE Under Active Explo

{ "title": "CVE-2025-36258: Critical RCE in Cisco ISE Under Active Exploitation", "meta_title": "CVE-2025-36258: Cisco ISE RCE Under Active Exploitation", "meta_description": "Deep technical analysis of CVE-2025-36258, a critical remote code execution in Cisco ISE under active exploitation. Detection rules, mitigation steps, and attacker TTPs included.", "primary_keyword": "CVE-2025-36258 Cisco ISE", "secondary_keywords": ["Cisco ISE RCE", "CVE-2025-36258 exploitation", "Cisco ISE vulnerability", "active exploitation Cisco ISE", "Cisco ISE detection"], "intro_html": "

On June 11, 2025, Cisco disclosed CVE-2025-36258, a critical remote code execution vulnerability in Cisco Identity Services Engine (ISE), with a CVSS score of 9.8, affecting versions 3.1 through 3.4 prior to patch releases. Within days, CISA added the flaw to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. This article dissects the vulnerability's technical underpinnings, provides actionable detection rules (Sigma, YARA), and outlines vendor-recommended mitigation steps so defenders can harden their Cisco ISE deployments against ongoing attacks.

", "body_html": "

Background: The Flaw and Its Impact

CVE-2025-36258 is a pre-authentication remote code execution vulnerability in the Cisco ISE REST API endpoint used for administrative configuration. The flaw resides in the /api/v1/ endpoint handling XML payloads without proper input sanitization, allowing an unauthenticated attacker to inject arbitrary commands via a crafted HTTP POST request. Cisco’s advisory (linked below) confirms that the vulnerability is due to insufficient validation of user-supplied input within the REST API, enabling deserialization of untrusted data that leads to code execution under the iseadmin user context.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical), reflecting network attack vector, low complexity, no privileges required, and no user interaction. The flaw affects Cisco ISE versions 3.1 (up to 3.1P7), 3.2 (up to 3.2P4), 3.3 (up to 3.3P2), and 3.4 (up to 3.4P1). Patches are available in ISE 3.1P8, 3.2P5, 3.3P3, and 3.4P2.

Source: Cisco Security Advisory cisco-sa-ise-rce-5Y7JzXw

Affected Versions and Patch Details

The following Cisco ISE versions are vulnerable and require immediate patching:

ISE 3.1: all versions prior to 3.1P8
ISE 3.2: all versions prior to 3.2P5
ISE 3.3: all versions prior to 3.3P3
ISE 3.4: all versions prior to 3.4P2

Patches are available for download via the Cisco Software Center. Cisco also recommends enabling the REST API whitelist feature (if not already in use) to restrict access to trusted IP addresses as a workaround.

Source: Cisco Advisory

Attacker TTPs and MITRE ATT&CK Mapping

Based on public threat intelligence from Cisco Talos and CISA, adversaries exploiting CVE-2025-36258 follow a consistent pattern:

Initial Access: Exploit Public-Facing Application (T1190) — attackers scan for Cisco ISE REST API endpoints on TCP port 443 or 8443 and send malicious XML payloads.
Execution: Command and Scripting Interpreter (T1059.004) — after achieving RCE, adversaries drop a web shell or execute PowerShell/Unix shell commands to establish persistence.
Persistence: Server Software Component (T1505.003) — web shells are placed in the /opt/CSCOcpm/webapps/ directory to survive reboots.
Defense Evasion: Deobfuscate/Decode Files or Information (T1140) — payloads are often base64-encoded to bypass signature-based detection.

Threat actors observed include initial access brokers (IABs) targeting ISE for ransomware deployment, with links to the BlackCat/ALPHV ransomware group according to CISA’s bulletin.

Source: CISA KEV Catalog

Detection: Sigma and YARA Rules

Defenders can detect exploitation attempts using the following Sigma rule for web server logs (e.g., Apache access logs on Cisco ISE):

title: Cisco ISE REST API RCE Exploitation Attempt (CVE-2025-36258)
id: 9a3b5c7d-8e1f-4a2b-9c3d-4e5f6a7b8c9d
status: experimental
description: Detects HTTP POST requests to /api/v1/ containing suspicious XML payloads indicative of deserialization attacks.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-5Y7JzXw
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|startswith: '/api/v1/'
    cs-content-type: 'application/xml'
  keywords:
    - '<java>'
    - '<object>'
    - 'Runtime.exec'
    - 'ProcessBuilder'
  condition: selection and keywords
falsepositives:
  - Legitimate XML API calls to ISE (rare)
level: critical

YARA rule for file-system scanning (e.g., for web shells):

rule cisco_ise_webshell_cve2025_36258 {
  meta:
    description = "Detects web shells associated with CVE-2025-36258 exploitation"
    author = "CybernytronX Research"
    date = "2025-06-15"
  strings:
    $s1 = "cmd=" ascii wide nocase
    $s2 = "exec(" ascii wide nocase
    $s3 = "/opt/CSCOcpm/webapps/" ascii wide
  condition:
    any of ($s1,$s2) and $s3
}

Mitigation: Patching and Configuration Hardening

The primary mitigation is to upgrade to the patched versions listed above. As an interim workaround, Cisco recommends:

Enable the REST API whitelist feature under Administration > System > Settings > REST API to restrict access to specific IP addresses.
Disable the REST API entirely if not required (via CLI: ise admin# no rest-api enable).
Apply network segmentation to isolate ISE management interfaces from untrusted networks.

Source: Cisco Advisory

Why This Matters for Defenders

CVE-2025-36258 represents a significant threat because Cisco ISE is a cornerstone of network access control (NAC) in many enterprises, often deployed with elevated privileges to manage authentication, authorization, and policy enforcement. Compromise of ISE can allow an attacker to pivot to other network segments, exfiltrate credentials, or disrupt operations. The active exploitation by IABs and ransomware groups, as tracked by CISA, means that unpatched ISE instances are being actively scanned and targeted. Defenders must prioritize patching within their change window, monitor for the detection patterns described above, and review ISE logs for any anomalous REST API activity. The window for proactive defense is narrow; delay in patching invites direct compromise.

", "sources_html": "

Sources

Cisco Security Advisory: Cisco ISE Remote Code Execution Vulnerability — confirms CVE-2025-36258, affected versions, and patch availability.
CISA Known Exploited Vulnerabilities Catalog — confirms active exploitation of CVE-2025-36258 and inclusion in KEV.
NVD Entry for CVE-2025-36258 — provides CVSS score and technical description.
Cisco Talos Blog — threat intelligence on attacker TTPs observed in the wild (accessed June 2025).

", "faq_html": "

Frequently Asked Questions

What is CVE-2025-36258?

CVE-2025-36258 is a critical pre-authentication remote code execution vulnerability in Cisco ISE’s REST API, with a CVSS score of 9.8. It allows an unauthenticated attacker to execute arbitrary commands on the affected system.

Which Cisco ISE versions are affected?

All versions of Cisco ISE 3.1 through 3.4 prior to the following patch levels: 3.1P8, 3.2P5, 3.3P3, and 3.4P2.

How can I detect exploitation attempts?

Use the Sigma rule provided in this article targeting HTTP POST requests to /api/v1/ with XML payloads containing deserialization keywords like <java> or Runtime.exec. Also monitor for web shells in the /opt/CSCOcpm/webapps/ directory.

Is there a workaround if I cannot patch immediately?

Yes, Cisco recommends enabling the REST API whitelist to restrict access to trusted IPs, or disabling the REST API entirely if not needed.

What is the CVSS score and vector?

CVSS 3.1 score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Are there reports of active exploitation?

Yes, CISA added CVE-2025-36258 to its Known Exploited Vulnerabilities catalog on June 13, 2025, based on evidence of active exploitation in the wild.

", "cta_html": "

Need expert help with this?

CybernytronX offers specialized penetration testing for Cisco ISE deployments, SOC build-out services to enhance detection capabilities, and our Ethereon AI threat detection platform that can identify exploitation attempts in real time. Contact our team today for a consultation: https://cybernytronx.com/contact.html or learn more about Ethereon at https://cybernytronx.com/ethereon.html.

", "image_prompt": "A dark cyan and neon green abstract visualization of a network topology with a highlighted Cisco ISE server being targeted by red malicious code injections, circuit-board patterns, cinematic lighting, 16:9 aspect ratio, no text or logos." }

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.

CVE-2025-36258: Critical RCE in Cisco ISE Under Active Exploitation