VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 13:03 UTC
← Dashboard

CVE-2025-20337

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerabi…

Read full description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.9/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 74.50%: +0.37

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 19 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

BleepingComputer
Press · 08 Jan 2026, 08:00 · Cisco warns of Identity Service Engine flaw with exploit code - BleepingComputer
Forbes
Press · 14 Nov 2025, 08:00 · Amazon CISO Confirms Hacker Exploit Used 2 Zero-Day Attacks - Forbes
csoonline.com
Press · 13 Nov 2025, 08:00 · Zero-day exploits hit Cisco ISE and Citrix systems in an advanced campaign - csoonline.com
SecurityWeek
Press · 13 Nov 2025, 08:00 · Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon - SecurityWeek
Amazon Web Services (AWS)
Press · 12 Nov 2025, 08:00 · Amazon discovers APT exploiting Cisco and Citrix zero-days - Amazon Web Services (AWS)
See all 19 source documents
CyberScoop
Press · 12 Nov 2025, 08:00 · Amazon pins Cisco, Citrix zero-day attacks to APT group - CyberScoop
The Hacker News
Press · 12 Nov 2025, 08:00 · Amazon Uncovers Attacks Exploited Cisco ISE and Citrix NetScaler as Zero-Day Flaws - The Hacker News
The Record from Recorded Future News
Press · 12 Nov 2025, 08:00 · ‘Advanced’ hacker seen exploiting Cisco, Citrix zero-days - The Record from Recorded Future News
BleepingComputer
Press · 12 Nov 2025, 08:00 · Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks - BleepingComputer
Infosecurity Magazine
Press · 29 Jul 2025, 07:00 · CISA Warns of Exploited Critical Vulnerabilities in Cisco Identity Services Engine - Infosecurity Magazine
BleepingComputer
Press · 28 Jul 2025, 07:00 · Exploit available for critical Cisco ISE bug exploited in attacks - BleepingComputer
thezdi.com
Press · 25 Jul 2025, 07:00 · CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability - thezdi.com
SecurityWeek
Press · 23 Jul 2025, 07:00 · Hackers Start Exploiting Critical Cisco ISE Vulnerabilities - SecurityWeek
Help Net Security
Press · 23 Jul 2025, 07:00 · Maximum severity Cisco ISE vulnerabilities exploited by attackers - Help Net Security
The Hacker News
Press · 22 Jul 2025, 07:00 · Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access - The Hacker News
The Hacker News
Press · 17 Jul 2025, 07:00 · Cisco Warns of Critical ISE Flaw Allowing Unauthenticated Attackers to Execute Root Code - The Hacker News
SecurityWeek
Press · 17 Jul 2025, 07:00 · Cisco Patches Another Critical ISE Vulnerability - SecurityWeek
Security Affairs
Press · 17 Jul 2025, 07:00 · Cisco patches critical CVE-2025-20337 bug in Identity Services Engine with CVSS 10 Severity - Security Affairs
BleepingComputer
Press · 17 Jul 2025, 07:00 · Max severity Cisco ISE bug allows pre-auth command execution, patch now - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.9 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 74.5%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:29.589072+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
16 Jul 2025, 16:17
First press mention
17 Jul 2025, 07:00
Added to the CISA KEV catalog
28 Jul 2025, 00:00
Latest press mention
08 Jan 2026, 08:00
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar