Active Exploitation of Cisco and Citrix 0-Day Vulnerabilities Allows Webshell Deployment

Amazon’s threat intelligence team has uncovered a sophisticated cyber campaign that exploits previously undisclosed zero-day vulnerabilities in Cisco Identity Service Engine (ISE) and Citrix systems, deploying custom webshells to gain unauthorised administrative access. The campaign is using zero-days CVE-2025-20337 for Cisco ISE, enabling pre-authentication remote code execution, and CVE-2025-5777 for Citrix Systems, classified as critical and under active exploitation.

Initial discovery came through Amazon’s MadPot honeypot service, which detected Citrix Bleed Two exploitation before public disclosure and revealed a companion Cisco ISE zero-day in the wild. The attackers deployed a memory-resident webshell masquerading as a legitimate Cisco ISE component called IdentityAuditAction, leveraging Java reflection to inject into Tomcat-running applications and registering as an HTTP request listener on the Tomcat server.

They use non-standard DES encryption with custom Base64 encoding to dodge detections, and access to the webshell requires knowledge of specific HTTP headers plus an extra authentication layer, according to Amazon Threat Intelligence.