Loading story…
Hackers exploited a zero-day vulnerability in Cisco's Identity Services Engine (ISE), tracked as CVE-2025-20337, which allowed for pre-authentication remote code execution and administrator-level access to affected systems. Amazon Web Services researchers detected the campaign using their MadPot honeypot, observing that attackers deployed custom web shells disguised as legitimate Cisco ISE components, specifically IdentityAuditAction, and used Java APIs to inject themselves into running threads and monitor HTTP requests on Tomcat servers. The vulnerability, rated with a maximum CVSS score of 10, was actively exploited in the wild before Cisco had assigned a CVE or released comprehensive patches for all affected ISE branches.
Cisco released a patch for the flaw in July after confirming in-the-wild exploitation, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2025-20337 to its Known Exploited Vulnerabilities catalog. AWS CISO CJ Moses highlighted that the attackers' use of "patch-gap exploitation"—targeting systems before official disclosure and patch availability—demonstrates the sophistication of threat actors who rapidly weaponize newly discovered vulnerabilities. Organizations using Cisco ISE are urged to ensure patches are applied and to monitor for signs of compromise, particularly the presence of suspicious web shells or unauthorized HTTP listeners.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
BankInfoSecurity and GovInfoSecurity reported that attackers exploited a zero-day vulnerability affecting Cisco Identity Services Engine (ISE). No additional technical details, victim information, or remediation timeline were provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon's threat intelligence team uncovered an advanced persistent threat (APT) actor actively exploiting two previously unknown zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix NetScaler ADC. The vulnerabilities, tracked as CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-20337, allowed attackers to bypass authentication on Citrix NetScaler and achieve unauthenticated remote code execution on Cisco ISE, respectively. Amazon's MadPot honeypot network detected exploitation attempts before public disclosure, and further investigation revealed the deployment of a custom web shell disguised as a legitimate Cisco ISE component, enabling persistent access for the attackers. Both vulnerabilities were exploited in the wild before patches were available, highlighting the attackers' sophistication and their focus on critical identity and network access infrastructure. The campaign demonstrated the threat actors' ability to quickly weaponize vulnerabilities and exploit patch gaps, with Amazon sharing technical details and indicators of compromise with Cisco to aid in remediation. The custom malware used in these attacks was specifically tailored for Cisco ISE environments, and the exploitation activity underscores the increasing targeting of systems that enforce enterprise security policies and manage authentication. Both Cisco and Citrix have since released patches to address the vulnerabilities, but the incident serves as a warning about the risks posed by zero-day exploitation of core network and identity management platforms.
Jun 29, 2026
Cisco disclosed multiple vulnerabilities in **Identity Services Engine (ISE)** and **ISE-PIC** that could let attackers compromise deployments through **authentication bypass**, **unauthenticated remote code execution**, and **path traversal**. One of the issues, tracked as **`CVE-2025-20281`**, was described in public research as allowing unauthenticated attackers to achieve **remote code execution as root** because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure. Separate Cisco advisories also detailed additional **authentication bypass** weaknesses and a combination of **remote code execution and path traversal** flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for `CVE-2025-20281` increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
Jun 29, 2026
Cisco disclosed two high-severity vulnerabilities in **Cisco Identity Services Engine (ISE)**, tracked as `CVE-2026-20180` and `CVE-2026-20186`, that allow an authenticated attacker to execute arbitrary commands on the underlying operating system by sending crafted HTTP requests. Both issues require at least **Read Only Admin** credentials and stem from insufficient validation of user-supplied input; Cisco mapped the flaws to **`CWE-22`** and **`CWE-77`** respectively. Cisco assigned both vulnerabilities the same **CVSS v3.1** score vector: `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. Successful exploitation can provide user-level operating system access and may allow attackers to escalate privileges to **root**. Cisco warned that in **single-node ISE deployments**, exploitation could also make the affected node unavailable, creating a denial-of-service condition that prevents unauthenticated endpoints from accessing the network until the system is restored.
Jul 23, 2026