In September 2025, Cisco disclosed a critical vulnerability in Identity Services Engine (ISE) that allows an unauthenticated remote attacker to bypass SAML authentication by forging a signed assertion. Tracked as CVE-2025-59718, the flaw carries a CVSS score of 9.8 and affects ISE deployments using SAML for administrative or guest access. According to Cisco's advisory, the vulnerability stems from improper validation of SAML assertion signatures. This article breaks down the technical root cause, affected versions, attacker TTPs, detection opportunities, and mitigation steps so your team can assess exposure and respond.
Background: What Is CVE-2025-59718?
CVE-2025-59718 is an authentication bypass vulnerability in Cisco Identity Services Engine (ISE) that enables an attacker to forge SAML assertions and gain unauthorized access to the ISE web interface. Cisco published the advisory in September 2025, assigning a CVSS v3.1 base score of 9.8 (Critical). The flaw exists in the SAML single sign-on (SSO) integration, where ISE fails to properly validate the digital signature of SAML assertions received from an identity provider (IdP).
In a typical SAML flow, the IdP signs the assertion with its private key, and the service provider (here, ISE) verifies the signature using the IdP's public certificate. CVE-2025-59718 allows an attacker to craft a SAML response with a forged signature that ISE accepts as valid. This could permit authentication as an administrative user or access to protected resources, depending on the SAML configuration.
The vulnerability was discovered internally by Cisco during security testing. Cisco states it is not aware of any malicious exploitation in the wild as of the advisory date. However, given the criticality and the widespread deployment of ISE in enterprise networks, immediate patching is strongly recommended.
“A successful exploit could allow the attacker to bypass SAML authentication and gain unauthorized access to the affected system.” — Cisco Security Advisory, September 2025.
Affected Versions
Cisco ISE releases 3.1, 3.2, and 3.3 are affected when SAML authentication is configured. The vulnerability is fixed in ISE 3.1 Patch 9, 3.2 Patch 6, and 3.3 Patch 3. Cisco has also provided a software update for ISE 3.4. Administrators should consult the Cisco Security Advisory for the complete list of fixed releases and patch availability.
To determine if your ISE deployment is vulnerable, check the software version and whether SAML is enabled under Administration > System > Admin Access > Authentication. If SAML is not used, the vulnerability is not exploitable, but upgrading is still advised to maintain a supported posture.
Attacker TTPs and MITRE ATT&CK Mapping
An attacker exploiting CVE-2025-59718 would typically follow these steps, mapped to MITRE ATT&CK techniques:
- Reconnaissance (T1595): Identify exposed ISE admin interfaces via Shodan or network scanning. ISE admin portals are often reachable from internal networks or VPNs.
- Initial Access (T1190): Exploit the SAML validation flaw by sending a crafted SAML response to the ISE SAML assertion consumer service (ACS) endpoint, typically
/admin/SSO/Saml2/acs. - Credential Access (T1552): If administrative access is gained, attackers may extract stored credentials or configuration data from ISE.
- Lateral Movement (T1021): Use ISE's trusted integrations with Active Directory or network devices to move laterally.
Because the attack targets the authentication layer, it may not generate typical login failure events. Instead, look for anomalous SAML responses or unexpected successful authentications from unusual source IPs.
Detection: Sigma and Suricata Rules
Detecting exploitation requires monitoring both ISE logs and network traffic. The following Sigma rule detects suspicious SAML authentication events on ISE, though tuning is required based on your environment.
title: Cisco ISE SAML Authentication Bypass Attempt
id: 5a4d3e2f-1b7c-4a8e-9f0d-3c2b1a0e9d8c
status: experimental
description: Detects potential exploitation of CVE-2025-59718 via forged SAML assertions.
author: CybernytronX
date: 2025/10/01
logsource:
product: cisco
service: ise
category: authentication
detection:
selection:
event_type: 'SAML_AUTH'
outcome: 'success'
src_ip|cidr:
- '0.0.0.0/0' # Replace with known IdP IP ranges
filter:
src_ip|cidr:
- '10.0.0.0/8' # Example: internal IdP range
condition: selection and not filter
falsepositives:
- Legitimate IdP IPs not in filter
level: high
Network detection can focus on malformed SAML responses. The following Suricata rule alerts on SAML responses with a signature that does not match the expected certificate (simplified; requires tuning).
alert http any any -> any any (msg:"CVE-2025-59718 Cisco ISE SAML Assertion Forgery Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/SSO/Saml2/acs"; http_uri; content:"SAMLResponse"; http_client_body; pcre:"/SAMLResponse=[A-Za-z0-9+\/%]+/"; sid:1000001; rev:1;)
For YARA, consider scanning ISE logs for anomalies, but log-based detection is more effective. Ensure ISE audit logs are forwarded to your SIEM and correlated with IdP logs.
Mitigation and Patching
Cisco has released fixed software. Apply the following patches immediately:
- ISE 3.1 Patch 9
- ISE 3.2 Patch 6
- ISE 3.3 Patch 3
- ISE 3.4 (latest release)
If patching cannot be done immediately, disable SAML authentication and revert to local authentication as a temporary workaround. However, this may impact SSO functionality. Cisco also recommends restricting access to the ISE admin interface to trusted networks.
Refer to the Cisco advisory for detailed upgrade instructions and any additional mitigations.
Why This Matters for Defenders
Cisco ISE is a cornerstone of network access control (NAC) in many enterprises, often holding keys to network segmentation and identity-based access. A bypass in its SAML implementation undermines the trust model of federated identity. Even without public exploitation, the vulnerability is a high-value target for adversaries seeking to pivot into protected network segments. Defenders should prioritize patching, monitor for anomalous SAML authentications, and review ISE's role in their zero-trust architecture. Given the rise in identity-based attacks, this flaw underscores the need for defense-in-depth: signature validation, network segmentation, and continuous monitoring of authentication flows.
Sources
- Cisco Security Advisories for Identity Services Engine — Official list of ISE advisories, including CVE-2025-59718, with affected versions and fixed releases.
- NVD Entry for CVE-2025-59718 — National Vulnerability Database entry with CVSS score and references.
- CISA Known Exploited Vulnerabilities Catalog — Check for updates on exploitation status (not listed as of October 2025).
Frequently Asked Questions
Is CVE-2025-59718 being exploited in the wild?
As of Cisco's advisory in September 2025, there are no reports of active exploitation. However, given the critical severity, attackers may develop exploits; monitor Cisco and CISA for updates.
Does this affect ISE deployments that do not use SAML?
No. The vulnerability is only exploitable when SAML authentication is configured. Deployments using local authentication or other SSO methods are not affected.
What is the CVSS score of CVE-2025-59718?
Cisco assigned a CVSS v3.1 base score of 9.8 (Critical), reflecting the potential for unauthenticated remote access with high impact.
Can I mitigate without patching?
Yes, temporarily disable SAML authentication and use local accounts, or restrict admin access to trusted IPs. However, patching is the only complete fix.
How can I detect exploitation attempts?
Monitor ISE logs for successful SAML authentications from unexpected source IPs or with anomalous assertion attributes. Network detection can flag malformed SAML responses to the ACS endpoint.
Are there any public exploits?
No public exploit code has been released as of October 2025. Cisco advises prompt patching to prevent potential exploitation.
Need expert help with this?
CybernytronX specializes in vulnerability management and identity security. Our team can help you assess exposure to CVE-2025-59718, validate your ISE configuration, and implement detection rules. We also offer Ethereon AI threat detection to monitor for anomalous authentication events. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.