Cisco has disclosed a brand new maximum-severity security vulnerability impacting Id Companies Engine (ISE) and Cisco ISE Passive Id Connector (ISE-PIC) that might allow an attacker to execute arbitrary code on the underlying working system with elevated privileges.
Tracked as CVE-2025-20337, the shortcoming carries a CVSS rating of 10.0 and is just like CVE-2025-20281, which was patched by the networking tools main late final month.
“A number of vulnerabilities in a particular API of Cisco ISE and Cisco ISE-PIC may permit an unauthenticated, distant attacker to execute arbitrary code on the underlying working system as root. The attacker doesn’t require any legitimate credentials to use these vulnerabilities,” the corporate stated in an up to date advisory.
“These vulnerabilities are as a consequence of inadequate validation of user-supplied enter. An attacker may exploit these vulnerabilities by submitting a crafted API request. A profitable exploit may permit the attacker to acquire root privileges on an affected system.”
Kentaro Kawane of GMO Cybersecurity has been credited with discovering and reporting the flaw. Kawane was beforehand acknowledged for 2 different crucial Cisco ISE flaws (CVE-2025-20286 and CVE-2025-20282) and one other crucial bug in Fortinet FortiWeb (CVE-2025-25257)
CVE-2025-20337 impacts ISE and ISE-PIC releases 3.3 and three.4, no matter system configuration. It doesn’t affect ISE and ISE-PIC launch 3.2 or earlier. The difficulty has been patched within the following variations –
- Cisco ISE or ISE-PIC Launch 3.3 (Mounted in 3.3 Patch 7)
- Cisco ISE or ISE-PIC Launch 3.4 (Mounted in 3.4 Patch 2)
There is no such thing as a proof that the vulnerability has been exploited in a malicious context. That stated, it is all the time an excellent apply to make sure that programs are saved up-to-date to keep away from potential threats.
The disclosure comes as The Shadowserver Basis reported that risk actors are doubtless exploiting publicly launched exploits related to CVE-2025-25257 to drop internet shells on inclined Fortinet FortiWeb situations since July 11, 2025.
As of July 15, there are estimated to be 77 contaminated situations, down from 85 the day earlier than. Nearly all of the compromises are concentrated round North America (44), Asia (14), and Europe (13).
Data from the assault floor administration platform Censys reveals that there are 20,098 Fortinet FortiWeb home equipment on-line, excluding honeypots, though it is at present not recognized what number of of those are susceptible to CVE-2025-25257.
“This flaw permits unauthenticated attackers to execute arbitrary SQL instructions through crafted HTTP requests, resulting in distant code execution (RCE),” Censys stated.
