CVE-2025-20337: Cisco Identity Services Engine Injection Vulnerability
Vulnerability summary
CVE-2025-20337 is a critical (CVSS 10.0) Injection vulnerability in Cisco Identity Services Engine. It is known to be exploited: CISA lists it, first on 28-07-2025. EPSS estimates a 74.50% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
Timeline
- 16-07-2025PublishedVulnerability first disclosed.
- 28-07-2025Added to CISA KEVCisco Identity Services Engine Injection Vulnerability
- 18-08-2025CISA remediation dueApply mitigations per vendor instructions.
- 26-02-2026Last modifiedVulnerability information updated.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
74.50%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+6.90 pp
From 67.60% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 28-07-2025
- Federal due date
- 18-08-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. sec.cloudapps.cisco.com/security/… nvd.nist.gov/vuln/detail/CVE-2025-20337
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco4 products
- cisco identity services engine software3.3.0 | 3.3 Patch 2 | 3.3 Patch 1 | 3.3 Patch 3 | 3.4.0 | 3.3 Patch 4 | 3.4 Patch 1 | 3.3 Patch 5 | 3.3 Patch 6
- cisco ise passive identity connector3.2.0 | 3.1.0 | 3.3.0 | 3.4.0
- identity_services_engine3.3.0 | 3.3.0:patch1 | 3.3.0:patch2 | 3.3.0:patch3 | 3.3.0:patch4 | 3.3.0:patch5 | 3.3.0:patch6 | 3.4.0 | 3.4.0:patch1
- identity_services_engine_passive_identity_connector3.3.0 | 3.3.0:patch1 | 3.3.0:patch2 | 3.3.0:patch3 | 3.3.0:patch4 | 3.3.0:patch5 | 3.3.0:patch6 | 3.4.0 | 3.4.0:patch1
1 vendor · 4 products
References
2 links- sec.cloudapps.cisco.com/security/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337Government ResourceUS Government Resource