CVE-2025-2033710.0CriticalCWE-74

CVE-2025-20337: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Cisco · Cisco Identity Services Engine Software

Affected: Cisco Identity Services Engine Software · Exploitation: in CISA KEV since 28 Jul 2025

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

ExploitationIn CISA KEV

In CISA KEVCISA KEV catalogue28 Jul 2025
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not established: not seen

74.5%probability of exploitation in the next 30 days

99th percentile

050100

Higher than 99% of scored CVEs

10.0CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Cisco · Cisco Identity Services Engine Software3.3.0; 3.3 Patch 2; 3.3 Patch 1; 3.3 Patch 3; 3.4.0; 3.3 Patch 4 and 3 more
Cisco · Cisco ISE Passive Identity Connector3.2.0; 3.1.0; 3.3.0; 3.4.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV: Listed since 28 Jul 2025 · catalogue entry
Public check: No public nuclei template
Weakness: Injection · Injection and Smuggling
Vendor: Cisco
Published: July 2025
Band: Exploited in the wild, July 2025

What changed

28 Jul 2025
CISA added it to the KEV catalogue CISA

CoverageNo articles yet

No CyberSIXT article names CVE-2025-20337 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.