CVE-2025-20337

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Published: Jul 16, 2025Updated: Oct 28, 2025 Sources: CVE List NVD BDUCWE-74

10.0CRITICAL

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

In plain language

AI Act now

This is a critical flaw in Cisco Identity Services Engine that lets an outsider take over an affected system; small businesses using it should act now.

Executive summary

Unauthenticated remote code execution in a Cisco ISE API caused by insufficient validation of supplied input, allowing crafted requests to run code as root.

If affected, business impact

Full system takeoverIdentity service disruptionNetwork access compromiseSensitive data exposureRansomware risk

What to do now

Ask your IT provider to confirm whether you run Cisco Identity Services Engine or its Passive Identity Connector, and whether its API is reachable from the internet.
Apply the Cisco security update or mitigation specified in the vendor advisory; the supplied findings do not name a fixed version.
Restrict access to the affected API to trusted management networks until remediation is complete.
Review the system for unfamiliar administrator activity or unexpected configuration changes after remediation.

Patch / advisory Some work to apply

What is it

A weakness in the system’s management interface can let an outsider send a specially formed request and seize control of the underlying device. It is like an intruder finding a service entrance that opens directly into the building’s control room, then gaining the master keys.

Who is affected

This matters if your business runs Cisco Identity Services Engine, including its Passive Identity Connector deployment. It is a risk when the affected API can be reached by an attacker; no account is needed to use the flaw.

How urgent is it

Attackers are already exploiting this vulnerability in the real world, and U.S. government guidance required remediation by August 18, 2025. Treat this as an immediate incident-prevention priority: confirm exposure, apply Cisco’s remediation, and limit API access while that work is underway.

What to do — in detail

Identify all Cisco Identity Services Engine and Passive Identity Connector appliances, then determine whether the affected API is exposed beyond trusted administrative networks.
Follow Cisco’s advisory for the applicable supported release and install its vendor-provided remediation. The supplied findings do not provide fixed version numbers, so use the versions and upgrade path in Cisco’s advisory rather than guessing.
If an immediate update is delayed, restrict the affected API to a dedicated management network and allow access only from approved administrator systems.
The CISA KEV remediation due date was 2025-08-18. If remediation was not completed by then, prioritize it now and retain evidence of the update or mitigation.
Review appliance and network logs for unusual API requests, unexpected root-level activity, new administrator accounts, configuration changes, and unexplained outbound connections.

Technical context

CVE-2025-20337 is CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It is CWE-74 input-validation weakness in a specific Cisco ISE/ISE-PIC API: a remote unauthenticated attacker can submit a crafted API request and execute arbitrary operating-system code as root. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-28, confirming real-world exploitation; a public exploit is also available. EPSS prediction is not included because confirmed exploitation takes precedence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-74

Affected Products

Cisco Systems Inc.

commercial·USaka cisco, cisco systems

identity services engine

Networking Infrastructure

identity services engine passive identity connector

Networking Infrastructure

Cisco Identity Services Engine Software

Networking Infrastructure

Cisco ISE Passive Identity Connector

Networking Infrastructure

Cisco Identity Services Engine

Networking Infrastructure

Identity Services Engine Passive Identity Connector (ISE-PIC)

Networking Infrastructure

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Jul 28, 2025

Remediation due:Aug 18, 2025

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Is your org exposed to CVE-2025-20337?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Execution

Initial Access

View detailed technique mapping

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

sec.cloudapps.cisco.com

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337

cisa.gov

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-20337 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows