Cisco reports another critical vulnerability in Cisco ISE that enable enable unauthenticated root code execution
Take action: If you haven't patched your Cisco Identity Services Engine (ISE), DO IT NOW! Even if you already patched, you probably need to patch again. There are three maximum severity flaws that will harm your ISE. Cisco ISE usually controls network access to a lot of the infrastructure, so you don't want it to be hacked.
Learn More
Cisco is reporting a third critical security vulnerability affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) platforms that could allow unauthenticated remote attackers to execute arbitrary commands with root privileges.
As with the two previously reported flaws it's got the maximum CVSS severity score of 10.0
Vulnerability summary
- CVE-2025-20337 (CVSS score 10.0) - A recently disclosed vulnerability similar to CVE-2025-20281, caused by insufficient input validation in ISE APIs, allowing unauthenticated remote attackers to obtain root privileges through crafted API requests.
Previously reported critical flaws
- CVE-2025-20281 (CVSS score 10.0) - An unauthenticated remote code execution vulnerability in specific APIs of Cisco ISE and ISE-PIC that allows attackers to execute arbitrary operating system commands as root through insufficient validation of user-supplied input.
- CVE-2025-20282 (CVSS score 10.0) - An unauthenticated remote code execution vulnerability in internal APIs that enables attackers to upload arbitrary files to privileged directories and execute them with root privileges due to inadequate file validation checks.
The vulnerabilities are independent of each other - exploiting one does not require exploitation of another, and a software release affected by one vulnerability may not be affected by others.
The vulnerabilities impact different versions of Cisco ISE and ISE-PIC depending on the specific flaw:
- CVE-2025-20281 and CVE-2025-20337 affect ISE and ISE-PIC releases 3.3 and 3.4, regardless of device configuration
- CVE-2025-20282 impacts only version 3.4. Cisco ISE and ISE-PIC Release 3.2 and earlier versions are not vulnerable to any of these flaws.
Organizations running Release 3.4 Patch 2 are fully patched, but those on Release 3.3 Patch 6 must upgrade to Release 3.3 Patch 7 to patch for CVE-2025-20337
The company warned that customers who applied patches for CVE-2025-20281 and CVE-2025-20282 are not protected from CVE-2025-20337 and need to upgrade to ISE 3.3 Patch 7 or ISE 3.4 Patch 2. Previously released hot patches (ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz and ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz) have been deprecated as they failed to address CVE-2025-20337.
Update - As of 28th of July 2028, security researcher Bobby Gould published a PoC exploit chain for CVE-2025-20281 and CVE-2025-20337.
