Cisco alerts customers to second actively exploited zero-day in as many days
Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.
88
CVE-2025-20337
Unauthenticated Injection Flaw Allows Root RCE in Cisco ISE and ISE-PIC
CISA: Cisco Identity Services Engine Injection Vulnerability
- CVSS 3.1
- 10.0 critical
- EPSS
- 74%p99
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2025-20337 is a critical (CVSS 3.1: 10.0) injection vulnerability (CWE-74) in a specific API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker can trigger it by submitting a crafted request to the affected API, with no valid credentials required. Successful exploitation allows arbitrary code execution on the underlying operating system with root privileges, giving the attacker full control of the affected device, consistent with the changed-scope, high-impact CVSS score. Any organization running Cisco ISE or ISE-PIC is potentially affected; CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-07-28, and press reports indicate active exploitation, including zero-day use per Amazon threat intelligence coverage. EPSS assigns a 67% probability of exploitation within 30 days (99th percentile), and no public proof-of-concept is known.
What to do: Upgrade Cisco ISE and ISE-PIC to the fixed releases identified in Cisco's security advisory (fixed version details are not included in this data set), and check management/API logs for unauthenticated crafted API requests indicating exploitation. As an interim mitigation, restrict network access to the affected API and the ISE administration interface. Organizations covered by BOD 22-01 must apply vendor mitigations per Cisco's instructions or discontinue use of the product by the KEV remediation deadline.
| Product | Affected |
|---|---|
| Cisco Identity Services Engine (ISE) | — |
| Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) | — |
Estimated exposure
moderatelikely on the order of tens of thousands of enterprise deployments worldwide (deployment-pattern estimate; no public install or scan counts) — Cisco ISE is a leading enterprise network access control platform typically deployed as one or more appliances at mid-size and large organizations, most of which are on internal networks rather than internet-facing, so the plausible…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
KEVCISA Known Exploited Vulnerability
- Affected
- Cisco Identity Services Engine
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
- Vendors
- cisco
- Products
- identity services engine, identity services engine passive identity connector
- Weakness
- CWE-74
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
16 storiesCisco warns of max severity ISE zero-day exploited in attacks
Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.
84
60
60
60
60
60
60
CISA Warns of Exploited Vulnerabilities in Cisco Products
60
Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access
60
60
Maximum severity Cisco ISE vulnerabilities exploited by attackers
60
60
Cisco confirms active exploitation of ISE and ISE
60
60
60