CVE-2025-20337criticalunder attackCWE-74

CVE-2025-20337: critical vulnerability in Cisco Identity Services Engine Software

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco Identity Services Engine+ Monitor Cisco ISE Passive Identity Connector

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 10epss 74%
from disclosure to weapon
Published on NVDJul 16
CISA KEV+12d
Action required by CISAfederal deadline: 2025-08-18

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An unprotected API in Cisco ISE allows attackers to run malicious code on the system with full administrative privileges without needing any password or login. This is a critical security flaw because anyone on the internet can potentially take complete control of the device.

Technical detail

An unauthenticated remote attacker can exploit insufficient input validation in a specific Cisco ISE API endpoint to achieve arbitrary code execution with root privileges. The attack vector requires only a crafted API request with no pre-authentication required, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Cisco · Cisco Identity Services Engine SoftwareCisco · Cisco ISE Passive Identity Connector
Related CVEs — Cisco Identity Services Engine Software

In the same product, most dangerous first.

CVE-2025-20281CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 97.6%KEVCVE-2026-76460CRITICALCisco Identity Services Engine Authentication Bypass VulnerabilityEPSS 75.6%KEVCVE-2025-20282CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 38.7%CVE-2022-20964MEDIUMCVE-2022-20964EPSS 30.6%CVE-2022-20966MEDIUMCVE-2022-20966EPSS 27.6%CVE-2025-20284MEDIUMCisco Identity Services Engine Authenticated Remote Code Execution VulnerabilityEPSS 25.1%