CVE-2025-20337

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Scoring

• CVSS: 10 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-07-28
• Remediation due date: 2025-08-18
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-74

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337

More from Cisco

• CVE-2026-76418 — Secure Firewall ASA Software and Cisco Secure FTD Software
• CVE-2026-76519 — Secure Email Gateway
• CVE-2026-76504 — Catalyst SD-WAN Manager
• CVE-2026-76460 — Identity Services Engine
• CVE-2026-76461 — Secure Email Gateway