Critical 10.0
KEV-listed
CVE-2025-20337
2025 Cybersecurity Trends and Ransomware Activity
Vendor / product: Multer for Node.js, Microsoft SharePoint
Event date: 2025-12-01
Victim organization: Marks & Spencer, Co-op
Public PoC: Yes
First tracked by RiskWire: 2026-08-25
CISA KEV catalog
Added to KEV
Federal remediation due
2025-08-18 (398 days overdue)
Ransomware campaign use
Unknown
CISA description
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
Medusa ransomwareRansomHubBlack BastaQilinDragonForceLockBit 5.0SafePayDevManSilk TyphoonHelloKitty-to-HelloGookie
Sources & citations (1)
- Financial Exposure: From Cyber Risk To Business Impact cyble.com · 2026-08-25
References
See CVE-2025-20337 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →