# Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337) · pwn.watch > CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28. Page: https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281 · generated 2026-10-23T03:54:42.456Z ## Status - Severity: critical · status: closed · patch: patched - Product: Cisco Identity Services Engine - Started: 2025-07-28 · closed: 2025-07-28 - CVEs: CVE-2025-20281, CVE-2025-20337 - Affected: See vendor advisory / CISA notes (versions not always listed in KEV feed) - Fixed in: See vendor advisory linked in sources ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281/feed.xml - JSON Feed: https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json - This file: https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281/llms.txt ## Updates (newest first) - 2025-07-28: CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18). - 2025-07-28: CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18). ## Fix brief # Security brief: Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337) Source: https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281 · status: closed (closed Jul 28, 2025) · severity: critical · updated Jul 28, 2025 ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28. Severity detail: CVSS 10.0 (CNA, v3.1); actively exploited (CISA KEV) - Product: Cisco Identity Services Engine - CVE / advisory ids: CVE-2025-20281, CVE-2025-20337 ## Affected versions - See vendor advisory / CISA notes (versions not always listed in KEV feed) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - See vendor advisory linked in sources After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Jul 28, 2025: CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18). - Jul 28, 2025: CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18). ## Advisories - [Cisco advisory: Cisco Identity Services Engine](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6) (Cisco) - [NVD: CVE-2025-20281](https://nvd.nist.gov/vuln/detail/CVE-2025-20281) (NVD) - [NVD: CVE-2025-20337](https://nvd.nist.gov/vuln/detail/CVE-2025-20337) (NVD) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA) ## Caveats Derived from CISA KEV JSON feed catalogVersion 2026.10.21. CVSS from the CVE record (cvelistV5). Exact affected/fixed version strings are not always in the KEV record; verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier; many entries are older CVEs newly confirmed as exploited in 2025). --- Machine-readable: https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.