CVE-2025-20337: Cisco Identity Services Engine injection vulnerability in API

CVE-2025-20337 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2025-07-28

Cisco Identity Services Engine (ISE) is a security policy management platform used to control access to corporate networks. A critical vulnerability allows an unauthenticated attacker to take full control of the system over the network. If exploited, an attacker could gain root-level access, allowing them to steal sensitive data, disrupt network operations, or bypass security controls entirely.

Technologies: Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2025-20337 exploited in the wild?
Yes. CVE-2025-20337 is known to be exploited in the wild, first recorded on 28 July 2025. Treat it as urgent.
How severe is CVE-2025-20337?
Critical severity, with a CVSS score of 10, published 28 July 2025.
Which products and versions are affected?
Cisco Identity Services Engine 3.3.0, 3.4.0; Cisco Identity Services Engine Passive Identity Connector 3.3.0, 3.4.0.
Is there a fix for CVE-2025-20337?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-20337 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-20337?
Check whether you run Cisco Identity Services Engine or Cisco Identity Services Engine Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An injection vulnerability (CWE-74) exists in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input. A remote, unauthenticated attacker can exploit this by sending a specially crafted API request to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. This vulnerability has been observed being exploited in the wild and carries a CVSS 3.1 score of 10.0. Affected versions include 3.3.0 and 3.4.0 (including various patch levels).

Affected products

  • Cisco Identity Services Engine (ISE) 3.3.0, 3.4.0
  • Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) 3.3.0, 3.4.0

Timeline

  • 2025-07-16: disclosed: Initial disclosure by Cisco
  • 2025-07-28: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.