Cisco ISE and ISE-PIC Unauthenticated Remote Code Execution Vulnerability (CVE-2025-20337)
Executive & SecOps Summary
SECOPS ASSESSMENTSpecific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC
An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system
Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the Cisco Security Advisory (cisco-sa-ise-unauth-rce-ZAd2GnJ6) to download and apply the appropriate patch. Use the following CLI commands to install the patch on Cisco ISE:
# Access Cisco ISE CLI and install the patch from a configured repository
# (Replace with the actual patch filename and repository name)
ise/admin# patch install ise-patch-bundle.tar.gz repository remote_repo2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the Cisco ISE management and API ports (e.g., TCP 443, 9060) using network firewalls or Access Control Lists (ACLs).
# Example ACL configuration on a Cisco ASA/FTD to restrict ISE API access
access-list RESTRICT_ISE_API extended permit tcp 10.100.1.0 255.255.255.0 host 192.168.10.50 eq 443
access-list RESTRICT_ISE_API extended deny tcp any host 192.168.10.50 eq 443
access-list RESTRICT_ISE_API extended deny tcp any host 192.168.10.50 eq 90603. Log Audit & IoC Verification Commands
Verify the current software version and patch level of your Cisco ISE deployment to ensure compliance.
# Check the current version and applied patches via Cisco ISE CLI
ise/admin# show version
ise/admin# show patchStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-20337) exists in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input (CWE-74). An unauthenticated, remote attacker can exploit this flaw by submitting a crafted API request to the vulnerable endpoint, leading to command injection or arbitrary code execution.
2. Exploitation Mechanics & Attack Scenario
An attacker can target the exposed API interface of Cisco ISE without requiring any valid credentials. By sending a specially crafted HTTP API request containing malicious payloads, the attacker bypasses input validation mechanisms. The underlying operating system executes the injected commands, granting the attacker full administrative control over the system.
3. Infrastructure & Business Impact
Cisco ISE is a critical network access control and identity management platform. With a CVSS score of 10.0 and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation allows the attacker to obtain root privileges, potentially leading to complete compromise of the network authentication infrastructure and enabling lateral movement across the enterprise network.
Official Vendor Advisories & References
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Frequently Asked SecOps Questions (CVE-2025-20337)
FAQQ1. How critical is CVE-2025-20337 and is it actively exploited in the wild?
CVE-2025-20337 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 74.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-20337?
Primary impacted vendors include cisco across identity services engine, ise-pic. Scope summary: Cisco Identity Services Engine (ISE) and Cisco ISE-PIC versions with the vulnerable API enabled
Q3. What temporary mitigations or workarounds exist for CVE-2025-20337 before patching?
[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-20337
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.