Cisco has disclosed a brand new maximum-severity safety vulnerability impacting Identification Companies Engine (ISE) and Cisco ISE Passive Identification Connector (ISE-PIC) that might allow an attacker to execute arbitrary code on the underlying working system with elevated privileges.
Tracked as CVE-2025-20337, the shortcoming carries a CVSS rating of 10.0 and is just like CVE-2025-20281, which was patched by the networking tools main late final month.
“A number of vulnerabilities in a particular API of Cisco ISE and Cisco ISE-PIC might permit an unauthenticated, distant attacker to execute arbitrary code on the underlying working system as root. The attacker doesn’t require any legitimate credentials to take advantage of these vulnerabilities,” the corporate stated in an up to date advisory.
“These vulnerabilities are resulting from inadequate validation of user-supplied enter. An attacker might exploit these vulnerabilities by submitting a crafted API request. A profitable exploit might permit the attacker to acquire root privileges on an affected gadget.”
Kentaro Kawane of GMO Cybersecurity has been credited with discovering and reporting the flaw. Kawane was beforehand acknowledged for 2 different crucial Cisco ISE flaws (CVE-2025-20286 and CVE-2025-20282) and one other crucial bug in Fortinet FortiWeb (CVE-2025-25257)
CVE-2025-20337 impacts ISE and ISE-PIC releases 3.3 and three.4, no matter gadget configuration. It doesn’t influence ISE and ISE-PIC launch 3.2 or earlier. The problem has been patched within the following variations –
- Cisco ISE or ISE-PIC Launch 3.3 (Mounted in 3.3 Patch 7)
- Cisco ISE or ISE-PIC Launch 3.4 (Mounted in 3.4 Patch 2)
There isn’t any proof that the vulnerability has been exploited in a malicious context. That stated, it is at all times follow to make sure that methods are saved up-to-date to keep away from potential threats.
The disclosure comes as The Shadowserver Basis reported that risk actors are possible exploiting publicly launched exploits related to CVE-2025-25257 to drop net shells on prone Fortinet FortiWeb situations since July 11, 2025.
As of July 15, there are estimated to be 77 contaminated situations, down from 85 the day earlier than. Nearly all of the compromises are concentrated round North America (44), Asia (14), and Europe (13).
Information from the assault floor administration platform Censys reveals that there are 20,098 Fortinet FortiWeb home equipment on-line, excluding honeypots, though it is presently not recognized what number of of those are weak to CVE-2025-25257.
“This flaw allows unauthenticated attackers to execute arbitrary SQL instructions through crafted HTTP requests, resulting in distant code execution (RCE),” Censys stated.
