Exploitation evidence
Known exploited · CISA KEV listed
Added 2025-07-28. Ransomware campaign use: Unknown.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: 2025-08-18. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Cisco / Cisco Identity Services Engine Software
Default status: unknown
- affected: 3.3.0
- affected: 3.3 Patch 2
- affected: 3.3 Patch 1
- affected: 3.3 Patch 3
- affected: 3.4.0
- affected: 3.3 Patch 4
- affected: 3.4 Patch 1
- affected: 3.3 Patch 5
- affected: 3.3 Patch 6
Cisco / Cisco ISE Passive Identity Connector
Default status: unknown
- affected: 3.2.0
- affected: 3.1.0
- affected: 3.3.0
- affected: 3.4.0
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.74499,
"percentile": 0.99503
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.74499,
"percentile": 0.99499
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.74499,
"percentile": 0.99498
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.74499,
"percentile": 0.99498
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.74499,
"percentile": 0.99498
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.74499,
"percentile": 0.99497
}06 Nov 2026, 06:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.74499,
"percentile": 0.99497
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.74499,
"percentile": 0.99496
}04 Nov 2026, 00:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20337",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-26T03:55:52.398837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-07-28",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:50:30.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-07-28T00:00:00.000Z",
"value": "CVE-2025-20337 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Identity Services Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.3 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 3"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.3 Patch 4"
},
{
"status": "affected",
"version": "3.4 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 5"
},
{
"status": "affected",
"version": "3.3 Patch 6"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco ISE Passive Identity Connector",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "In July 2025, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-25T12:26:22.077Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
}
],
"source": {
"advisory": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
"defects": [
"CSCwo99449"
],
"discovery": "EXTERNAL"
},
"title": "Cisco ISE API Unauthenticated Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20337",
"datePublished": "2025-07-16T16:17:04.664Z",
"dateReserved": "2024-10-10T19:15:13.255Z",
"dateUpdated": "2026-02-26T17:50:30.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.74499,
"percentile": 0.99496
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.74499,
"percentile": 0.99496
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2025-20337",
"cwes": [
"CWE-74"
],
"dateAdded": "2025-07-28",
"dueDate": "2025-08-18",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Unknown",
"notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20337",
"product": "Identity Services Engine",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
"vendorProject": "Cisco",
"vulnerabilityName": "Cisco Identity Services Engine Injection Vulnerability"
}