Exploited vulnerabilitiesBriefPublic record

Cisco ISE unauthenticated RCE (CVE-2025-20281 / -20337)

CVSS 10. KEV: 28 Jul 2025.

Disclosed

Live scores

Live scores

CVE-2025-20281
EPSS
0.976
very likely to be attacked soon
VEDAS
0.984
strong exploit evidence
On CISA KEV
Yes, since 2025-07-28
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1Added to CISA KEV 2025-07-28CVE-2025-20281 EPSS over time2025-062026-11-01
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.9Added to CISA KEV 2025-07-28CVE-2025-20281 VEDAS over time2025-062026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Live scores

CVE-2025-20337
EPSS
0.745
very likely to be attacked soon
VEDAS
0.977
strong exploit evidence
On CISA KEV
Yes, since 2025-07-28
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1Added to CISA KEV 2025-07-28CVE-2025-20337 EPSS over time2025-072026-11-01
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.9Added to CISA KEV 2025-07-28CVE-2025-20337 VEDAS over time2025-072026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.