KEVIntel
PRO Back to KEVs
10.0
CVSS
Critical

CVE-2025-20337

PUBLISHED

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

1 day faster than CISA KEV

Exploited in the wild Remote Low complexity No user interaction
Vendor
Cisco
Product
Cisco Identity Services Engine Software, Cisco ISE Passive Identity Connector
Published
Jul 16, 2025
EPSS
1.4% · 81% pctl

Automate This Intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

cisa edge

Weaknesses (CWE)

  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-01 10:37:36 UTC · CVE

References

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE First 2026-06-01 10:37 UTC
CISA 2026-06-02 14:06 UTC

Timeline

  • KEV confirmed by CISA

  • Added to KEVIntel

  • CVE Published to Public

  • CVE ID Reserved