Exploited vulnerability · CISA KEV

Is CVE-2025-20362 exploited? Yes: in CISA KEV since 25 Sep 2025

Gociux · Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-20362, Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 25 Sep 2025, the day it was published. It affects Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

What it is

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

What to do

1. Check whether you run it. Look for Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense in your asset inventory, including appliances and cloud images. Stack check lists every exploited Cisco CVE at once.
2. Apply the fix. The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 25 Sep 2025.
4. Get told next time. Email alerts when CISA adds a CVE for Cisco.

Other exploited CVEs in Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

• CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability (25 Sep 2025)

References

• www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core
• www.cisa.gov/eviction-strategies-tool/create-from-template
• sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
• sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks
• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaf
• nvd.nist.gov/vuln/detail/CVE-2025-20362

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in September 2025 · Cisco scorecard · act-now radar.