DaystoPatch

CiscoExploited incident

Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities (CVE-2025-20281, CVE-2025-20337)

CVE-2025-20281, CVE-2025-20337Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 28 Jul 2025

  • Exploited after a fix existed
FixedFixed for every supported version 21 days after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
21d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6, v1.0 (Wayback snapshot 2025-06-26)CuratedQuote verified

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user.

    Coordinated disclosure of CVE-2025-20281 (and CVE-2025-20282) in v1.0, First Published 2025 June 25 16:00 GMT; v1.0 said Cisco was not aware of malicious use. CVE-2025-20337 was added to the advisory in v2.0 on 2025-07-16.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a654c24b9a5ef2c8…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    CVE.org record CVE-2025-20281ClaimedQuote verified25 Jun 2025, 16:11 UTC

    A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f74458575e32086a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Jun 2025, 16:26 UTC

    You can now share your thoughts on vulnerability CVE-2025-20281 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet17 Jul 2025, 05:04 UTC

    CVE Alert: CVE-2025-20337 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-20337/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_20337

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco CSAF for cisco-sa-ise-unauth-rce-ZAd2GnJ6, revision 2.1.0CuratedQuote verified21 Jul 2025, 18:03 UTC

    Updated to indicate active exploitation attempts in the wild.

    CSAF revision 2.1.0 is dated 2025-07-21T18:03:51+00:00. Revision 2.2.0 (2025-07-24T23:30:31+00:00; the HTML table shows 2025-JUL-25) named CVE-2025-20281 and CVE-2025-20337 as the exploited CVEs: 'In July 2025, the Cisco PSIRT became aware of attempted exploitation of CVE-2025-20281 and CVE-2025-20337 in the wild.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:549722cbcfa3c958…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-20281)ClaimedQuote verified28 Jul 2025

    Cisco Identity Services Engine Injection Vulnerability

    Added to CISA's KEV catalog on 2025-07-28.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-20337)ClaimedQuote verified28 Jul 2025

    Cisco Identity Services Engine Injection Vulnerability

    Added to CISA's KEV catalog on 2025-07-28.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet15 Sep 2025, 18:33 UTC

    backdoors and evades analysis (e.g., UPX header tampering, nanosecond delays) Vulnerabilities exploited (At this moment): CVE-2025-20281 (Cisco ISE) CVE-2023-1389 (TP-Link AX21) CVE-2020-8515 (DrayTek) CVE-2024-7120 (Raisecom MSG) Mitigation ideas I’m testing: Scanning client networks for vulnerable

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6CuratedQuote verified

    First Published: 2025 June 25 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6df10eb35606664c…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6, v1.0 (Wayback snapshot 2025-06-26)CuratedQuote verified

    Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

    v1.0 fixes for CVE-2025-20281: 3.3 Patch 6 or hot patch ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz; 3.4 Patch 2 or hot patch ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a654c24b9a5ef2c8…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +21d

    Cisco PSIRT advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6, v2.0 (Wayback snapshot 2025-07-16)CuratedQuote verified

    The hot patches did not address CVE-2025-20337 and have been deferred from CCO.

    v2.0 (CSAF 2.0.0 at 2025-07-16T15:57:26+00:00) added CVE-2025-20337 with fixes 3.3 Patch 7 and 3.4 Patch 2, and said the June hot patches 'did not address CVE-2025-20337'. From this point both exploited CVEs were fixed on both affected trains (3.2 and earlier not vulnerable).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a613509983c2f796…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-ise-unauth-rce-ZAd2GnJ6

    Recorded in the revision history

    Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 16 Jul 2025, 19:53 UTC: archived copyLater version captured 22 Jul 2025, 15:11 UTC: archived copyRecovered from archived copiesSnapshots 1a98d8a789… and f538a0ceb5…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Identity Services Engine (ISE) 3.3 and 3.4
  • Cisco ISE Passive Identity Connector (ISE-PIC)
How we built this timeline

Grouped: CVE-2025-20281 and CVE-2025-20337 share one advisory and were named together as exploited; both added to KEV 28 Jul 2025. CVE-2025-20282 (same advisory) is not in KEV.

Coordinated disclosure, exploited later: the 16 Jul 2025 snapshot (v2.0) still says Cisco was not aware of malicious use, and exploitation was first stated on 21 Jul 2025, after fixes for both CVEs existed. Reported via Trend Micro ZDI (Bobby Gould: CVE-2025-20281;

Kentaro Kawane: CVE-2025-20282 and CVE-2025-20337). Customers who applied only the June hot patches remained exposed to CVE-2025-20337 until upgrading.

CORRECTION PASS 23 Oct 2026: R1 check: v2.0 'Updated Cisco ISE code fix' and the final table lists 3.3 Patch 7 (not Patch 6) as the first fix for CVE-2025-20281 on 3.3, so the 3.3 line's complete fix is 16 Jul 2025; on 3.4, 3.4 Patch 2 (listed since v1.0) remains the first fix, so First fix stays 25 Jun 2025 and Fixed for all versions 16 Jul 2025. Grouping: CVE-2025-20337 was added to the same advisory 21 days after CVE-2025-20281; they are grouped under the same-advisory rule (R7's 14-day test applies to chains across advisories).

The Fixed for all versions quote was changed because the earlier one spanned inline markup.

Related

Cisco report card