CVE-2025-20337
CRITICAL KEVCisco Identity Services Engine - Unauthenticated Remote Code Execution via API Request
Title source: llmExploitation Summary
CVE-2025-20337 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 28, 2025.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
References (2)
Core 2
Core References
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337
Scores
CVSS v3
10.0
EPSS
0.0135
EPSS Percentile
80.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
yes
Technical Impact
total
Details
CISA KEV
2025-07-28
VulnCheck KEV
2025-07-21
ENISA EUVD
EUVD-2025-21708
CWE
CWE-74
Status
published
Products (4)
cisco/identity_services_engine
3.3.0 (7 CPE variants)
cisco/identity_services_engine
3.4.0 (2 CPE variants)
cisco/identity_services_engine_passive_identity_connector
3.3.0 (7 CPE variants)
cisco/identity_services_engine_passive_identity_connector
3.4.0 (2 CPE variants)
Published
Jul 16, 2025
KEV Added
Jul 28, 2025
Tracked Since
Feb 18, 2026