Skip to content
Patcharo
Back to the results

Vulnerabilities

CriticalKEV

CVE-2025-20337 — Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

CVE-2025-20337 · Cisco Identity Services Engine Software · CVSS 10 ·…

In brief

Severity · CVSS
Critical10CVSS 3.1, Critical
EPSS
68%
CISA KEV
Known exploited, listed since 28 Jul 2025
Vendor
Cisco
Published · Modified
·
Last verified

Summary

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Weakness: CWE-74

Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.

Affected and fixed versions

Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.

4 branches with a published fixed release · 2 branches without a precise fixed release

Cisco Identity Services Engine Software

Source: cisco-sa-ise-unauth-rce-ZAd2GnJ6CVE-2025-20337

  1. 3.4
    Affected versions3.4, 3.4 Patch 1
    First fixed release3.4 Patch 2
  2. 3.3
    Affected versions3.3, 3.3 Patch 1, 3.3 Patch 2, 3.3 Patch 3
    7 releases listed3.3, 3.3 Patch 1, 3.3 Patch 2, 3.3 Patch 3, 3.3 Patch 4, 3.3 Patch 5, 3.3 Patch 6
    First fixed release3.3 Patch 7

Cisco ISE Passive Identity Connector

Source: cisco-sa-ise-unauth-rce-ZAd2GnJ6CVE-2025-20337

  1. 3.4
    Affected versions3.4
    First fixed release3.4 Patch 2
  2. 3.3
    Affected versions3.3
    First fixed release3.3 Patch 7
  3. 3.2
    Affected versions3.2
    First fixed releaseNot published in the sources followed
  4. 3.1
    Affected versions3.1
    First fixed releaseNot published in the sources followed

Remediation

Fix available

Vendor fix

  • Identity Services Engine Software 3.43.4 Patch 2
  • Identity Services Engine Software 3.33.3 Patch 7
  • ISE Passive Identity Connector 3.43.4 Patch 2
  • ISE Passive Identity Connector 3.33.3 Patch 7

Upgrade to a fixed release listed above for your branch, or to a later fixed release the vendor explicitly supports.

Cisco has released updates that fix this vulnerability; its advisory lists them.

SourceCisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6

Workarounds (vendor)

Cisco states in its advisory that no workaround is available.

SourceCisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6

CISA KEV required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date:

SourceCISA KEV

CERT-FR recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

SourceCERTFR-2025-AVI-0539

Last verified 1 Oct 2026 at 09:32 UTC

Known exploitation

Added to CISA KEV on 28 Jul 2025

Federal remediation due date: 18 Aug 2025

The CISA required action is shown under Remediation.

68% probability of exploitation in the next 30 days (percentile 99%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CERT-FR

1 document of the French national CERT (ANSSI) references this CVE.

Advisory (AVI)CERTFR-2025-AVI-0539Published 26 Jun 2025 · updated 1 Aug 2025

Multiple vulnerabilities in Cisco Identity Services Engine

Remote arbitrary code execution

Summary

Multiple vulnerabilities have been discovered in Cisco Identity Services Engine. They allow an attacker to cause remote arbitrary code execution. Cisco indicates that vulnerabilities CVE-2025-20281 and CVE-2025-20337 are actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

Official document on cert.ssi.gouv.frread by Patcharo 28 Sept 2026 at 20:04 UTCMachine translation of the French text published by CERT-FR; a text whose translation did not pass Patcharo's checks stays in French. Identifiers, versions and links are copied unchanged.

Timeline

  1. Published by the source
  2. Added to CISA KEV
  3. CISA remediation due date
  4. Source record last modified
  5. EPSS score computed
  6. Last verified by Patcharo

Official sources

References

Cisco · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS · Cisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6

How Patcharo reads this

Affected and fixed releases come from the vendor's structured statements and are matched against exact versions; CVSS from NVD, exploitation from CISA KEV and the vendor's own advisory, probability from FIRST EPSS. Missing data stays Unknown and never becomes Not affected.

Read the methodologyRead the guide: Cisco Secure Firewall release trains: Threat Defense, Management Center and ASA versions explained