Cisco on Wednesday informed customers of another critical-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could lead to remote code execution (RCE).
In an update to a June 25 advisory detailing two such flaws, tracked as CVE-2025-20281 and CVE-2025-20282, the tech giant added a fresh CVE to the list, alerting users of its maximum severity rating.
Tracked as CVE-2025-20337, the bug has a CVSS score of 10/10, the same as the other two issues, and impacts the same API as CVE-2025-20281.
“Multiple vulnerabilities in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit these vulnerabilities,” Cisco notes in its advisory.
The insufficient validation of user-supplied input, the company explains, could allow an attacker to submit a crafted API request and obtain root privileges on an affected device.
The security defects impact Cisco ISE and ISE-PIC versions 3.3 and 3.4, and were addressed in versions 3.3 patch 7 and 3.4 patch 2.
On Tuesday, Cisco also announced fixes for CVE-2025-20274 (CVSS score of 6.3), a high-severity vulnerability in the web-based management interface of Unified Intelligence Center that could be exploited for arbitrary file uploads.
Improper validation of files uploaded to the interface allows authenticated, remote attackers to store malicious files on the system, leading to the execution of arbitrary commands. The flaw could be exploited to elevate privileges to root, which increases its severity, Cisco says.
Patches for the issue were included in Unified Intelligence Center versions 12.5(1) SU ES05 and 12.6(2) ES05. Cisco recommends that users of Unified CCX versions 12.5(1) SU3 and earlier migrate to version 15, which is not affected.
The tech giant also announced patches for medium-severity security defects in ISE and ISE-PIC, Evolved Programmable Network Manager (EPNM), Prime Infrastructure, and Unified Intelligence Center.
Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page.
Related: Cisco Warns of Hardcoded Credentials in Enterprise Software
Related: High-Severity Vulnerabilities Patched by Cisco, Atlassian
Related: Cisco Patches Critical ISE Vulnerability With Public PoC
Related: Technical Details Published for Critical Cisco IOS XE Vulnerability
