Cisco Identity Services Engine (ISE)

Name: Cisco Identity Services Engine (ISE)
Brand: Cisco

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

1critical11high19medium0low

updated 2026-10-27

vulnerabilities (50)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-20281US	—OT critical	97.6% (100th)	KEV	3.3 Patch 7	2025-06-25	6 versions
CVE-2025-20337US	—OT critical	74.5% (99th)	KEV	3.4 Patch 2	2025-07-16	6 versions
CVE-2025-20282US	—	38.7% (99th)	Exploit	3.4 Patch 2	2025-06-25	6 versions
CVE-2025-20124US	high7.2	18.5% (97th)	Exploit	3.2P7	2025-02-05	4 versions
CVE-2025-20125US	high7.2OT high	16.4% (97th)	Exploit	3.3P4	2025-02-05	4 versions
CVE-2025-20343US	high7.5	0.71% (53rd)	Exploit	3.4 Patch 4	2025-11-05	2 versions
CVE-2025-20284US	high7.2	25.1% (98th)	—	3.4 Patch 2	2025-07-16	2 versions
CVE-2025-20283US	high7.2	13.2% (96th)	—	3.4 Patch 2	2025-07-16	2 versions
CVE-2026-20181US	—	8.93% (95th)	—	3.4 Patch 6	2026-06-17	4 versions
CVE-2026-20029US	—	6.08% (93rd)	—	3.3 Patch 8	2026-01-07	3 versions
CVE-2025-20303US	—	3.86% (90th)	—	3.2 Patch 8	2025-11-05	3 versions
CVE-2025-20286US	critical9.8OT elevated	1.15% (67th)	—	3.4P3	2025-06-04	3 versions
CVE-2024-20469US	medium6.7	1.12% (66th)	—	3.4	2024-09-04	3 versions
CVE-2025-20152US	high8.6	0.70% (53rd)	—	3.4P1	2025-05-21	< 3.4P1
CVE-2025-20130US	high7.2	0.63% (50th)	—	3.3 P3	2025-06-04	3 versions
CVE-2024-20528US	high7.2	0.61% (49th)	—	3.2P7	2024-11-06	4 versions
CVE-2024-20532US	medium5.5	0.53% (45th)	—	3.2P7	2024-11-06	4 versions
CVE-2024-20529US	medium5.5	0.53% (45th)	—	3.4P1	2024-11-06	4 versions
CVE-2024-20527US	medium5.5	0.53% (45th)	—	3.4P1	2024-11-06	4 versions
CVE-2026-20190US	—	0.50% (43rd)	—	3.5 Patch 3	2026-06-17	2 versions
CVE-2026-20146US	—	0.50% (42nd)	—	3.3 Patch 12	2026-07-15	5 versions
CVE-2024-20417US	high8.1	0.50% (42nd)	—	3.2P5	2024-08-21	3 versions
CVE-2024-20466US	medium4.9OT elevated	0.48% (41st)	—	3.3P2	2024-08-21	3 versions
CVE-2024-20537US	medium6.5OT elevated	0.46% (40th)	—	3.1P10	2024-11-06	3 versions
CVE-2025-20285US	medium4.1	0.45% (39th)	—	3.4 Patch 2	2025-07-16	2 versions
CVE-2025-20332US	—OT elevated	0.40% (34th)	—	3.2P8 (Nov 2025)	2025-08-06	4 versions
CVE-2024-20332US	—	0.37% (31st)	—	3.2P5	2024-04-03	2 versions
CVE-2025-20264US	—	0.36% (29th)	—	3.3 Patch 5	2025-06-25	4 versions
CVE-2024-20531US	medium6.5	0.35% (29th)	—	3.3P4	2024-11-06	4 versions
CVE-2024-20476US	medium4.9	0.35% (29th)	—	3.2P7	2024-11-06	3 versions
CVE-2024-20538US	medium6.1	0.34% (27th)	—	3.3P4	2024-11-06	3 versions
CVE-2024-20530US	medium6.1	0.34% (27th)	—	3.2P7	2024-11-06	4 versions
CVE-2024-20525US	medium6.1	0.34% (27th)	—	3.2P7	2024-11-06	4 versions
CVE-2025-20205US	medium4.8	0.33% (25th)	—	3.3P4	2025-02-05	6 versions
CVE-2025-20204US	medium4.8	0.33% (25th)	—	3.2P8	2025-02-05	6 versions
CVE-2025-20305US	medium4.9	0.30% (23rd)	—	3.4 Patch 4	2025-11-05	3 versions
CVE-2025-20131US	—	0.30% (22nd)	—	3.1 P10	2025-08-20	4 versions
CVE-2024-20368US	high8.8	0.30% (22nd)	—	3.3P2	2024-04-03	2 versions
CVE-2024-20487US	medium5.4	0.29% (21st)	—	3.1P10	2024-11-06	3 versions
CVE-2024-20539US	medium4.8	0.29% (21st)	—	3.3P4	2024-11-06	3 versions
CVE-2024-20515US	medium6.5OT elevated	0.29% (21st)	—	3.2P7	2024-10-02	3 versions
CVE-2024-20486US	high8.8	0.28% (21st)	—	3.3P2	2024-08-21	5 versions
CVE-2026-20195US	—	0.27% (20th)	—	3.4 Patch 6	2026-05-06	3 versions
CVE-2025-20267US	—	0.27% (19th)	—	3.3P5	2025-05-21	5 versions
CVE-2026-20076US	—	0.27% (19th)	—	3.3 Patch 5	2026-01-15	3 versions
CVE-2026-20047US	—	0.27% (19th)	—	3.3 Patch 5	2026-01-15	8 versions
CVE-2025-20331US	—	0.22% (13th)	—	3.3P4	2025-08-06	3 versions
CVE-2026-20193US	—OT elevated	0.22% (13th)	—	3.4 Patch 6	2026-05-06	3 versions
CVE-2025-20289US	medium5.4	0.21% (12th)	—	3.2 Patch 8	2025-11-05	3 versions
CVE-2025-20304US	—	0.21% (11th)	—	3.3 Patch 8	2025-11-05	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')10 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')6 CVEs
CWE-285Improper Authorization4 CVEs
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-284Improper Access Control2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)50 CVEs
NLNCSC-NL (CSAF)4 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan