Cisco warns of another critical RCE flaw in ISE, urges immediate patching – Source: www.csoonline.com

Cisco has dropped another maximum severity advisory detailing an unauthenticated remote code execution (RCE) flaw in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).

The networking equipment giant warned that the flaw, much similar to a critical bug it fixed last month, stems from insufficient input validation in a public API.

[ Related: More Cisco news and insights ]

“Cisco’s disclosure of the flaw highlights a troubling pattern in API-exposed infrastructure — insufficient input validation leading to unauthenticated remote code execution,” said Randolph Barr, chief information security officer at Cequence Security. “With a CVSS score of 10, this is a worst-case scenario: attackers can remotely gain root access without credentials or user interactions.”

Cisco has urged admins to consider the flaw as separate from CVE-2025-20281, another max-severity bug impacting the same identity and access management (IAM) products, and apply a targeted patch it has now released.

Root-level API RCE via crafted requests

The flaw, tracked as CVE-2025-20337, affects ISE and ISE-PIC versions 3.3 and 3.4 (but not 3.2 or earlier) and allows an attacker to run commands or malicious files as root, no credentials needed.

According to the Cisco advisory, incomplete request sanitization on a specific API, also the one affected by CVE-2025-20281, of Cisco ISE and Cisco ISE PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root.

Barr believes the flaw is all the more concerning with the rise of generative AI.

“What’s particularly concerning in 2025 is the role of generative AI in democratizing exploitation,” he said.“Attackers with little technical experience can now use AI to identify exposed Cisco ISE systems, craft malicious API requests, and launch targeted attacks, significantly accelerating the threat window.”

The bug is fixed in Cisco ISE Release 3.4 Patch 2 and Release 3.3 Patch 7. Cisco said there are no workarounds, and updating to a fixed version is the only remediation.

The company also warned that hot patches, “ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz” and “ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz,” installed in response to CVE-2025-20281, did not address CVE-2025-20337, and customers will have to update to the dedicated patched releases.

Faster patching is needed

Barr is concerned about the flaw in finding N-day abuse. “While it’s positive that Cisco is transparent in disclosure and swift in releasing patches, the reality is that patching these types of vulnerabilities — especially in large, distributed enterprise environments — is not instantaneous,” he said. “Restart requirements and dependencies on high-availability setups often delay full remediation.”

He added that the speed and simplicity of modern exploit development, especially through AI, should be a concern.

Jason Soroko, senior fellow at Sectigo, is more worried about the blast radius of a potential exploit. “ISE sits at the very edge of trust for many campus networks, and a breach can rewrite access policies, move endpoints between VLANs, and open pivots into every segment,” he said. “The vulnerable API is often reachable from broad internal address ranges, sometimes even guest Wi-Fi, and ISE patching requires disruptive maintenance windows.”

Active targeting feels likely because the flaws (CVE-2025-20281) already attracted public proof-of-concept exploits and scan traffic within days, Soroko added.

For additional protection, Barr recommends using specialized API security solutions that can detect and block anomalous API activity in real time, provide endpoint-risk scoring, and stop automated scanning and payload delivery.

Cisco has had a busy month, weathering a downpour of max-severity bugs. Earlier this month, the company patched another root-access issue in its communications gear, though that one was self-inflicted, with DevOps quietly stashing hardcoded credentials for internal use.