CVE-2025-20337

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

State: Published
Severity: 10.0 Critical
Published: Jul 16, 2025
Updated: Feb 26, 2026
Reserved: Oct 10, 2024

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	cisco

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
Cisco Identity Services Engine SoftwareCisco	3.3.0Affected 3.3 Patch 2Affected 3.3 Patch 1Affected 3.3 Patch 3Affected 3.4.0Affected 3.3 Patch 4Affected 3.4 Patch 1Affected 3.3 Patch 5Affected 3.3 Patch 6Affected
Cisco ISE Passive Identity ConnectorCisco	3.2.0Affected 3.1.0Affected 3.3.0Affected 3.4.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.