CVE-2025-20362
8.6, high Known exploitedCisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
- CVSS
- 8.6, high high CVSS v3.1
- EPSS, next 30 days
- 87% higher than 99.7% of scored CVEs
- Exploitation
- Confirmed in the wild
- Published
- 25 Sept 2025a year ago
Known exploited
CISA added this to the Known Exploited Vulnerabilities Catalog on 25 Sept 2025. US federal agencies had to remediate by 26 Sept 2025, a deadline that has passed.
Required action. The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Description
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
Details
- Vendor
- Cisco
- Product
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Weakness
- CWE-862 (opens in a new tab)
- Status
- Analyzed
- Updated
- 11 Aug 2026
- Assigner
- psirt@cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
References 3
Advisories 2
The kind is read from NVD's tags where present and from the shape of the URL otherwise, so treat it as a hint.
Other Cisco CVEs
Every Cisco CVE we holdSame vendor in what we hold, not a known link between the flaws.
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability KEV EPSS 2% 9.8, critical
- CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability KEV EPSS 2% 9.8, critical
- CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability KEV EPSS 14% 10, critical
- CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability KEV EPSS 30% 9.8, critical
- CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability KEV EPSS 1% 8.6, high
- CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability KEV EPSS 35% 5.3, medium
- CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability KEV EPSS 28% 6.5, medium
- CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability KEV EPSS 25% 7.8, high
Beyond this page
Is CVE-2025-20362 in your network?
This page tells you how dangerous CVE-2025-20362 is out there. Whether it sits on one of your devices, only a scan of your own network can tell. That is what our systems do, every day, for the companies we protect.
CVE-2025-20362 is in the CISA catalogue of exploited vulnerabilities: attackers are already exploiting it.
-
EXYS7600 OCELOT
Find it before attackers do
Ocelot scans your network on a schedule and reports every vulnerability it finds by its CVE identifier, with its CVSS score and how many of your hosts are affected. A finding like CVE-2025-20362 comes with the devices to patch.
Learn more about EXYS7600 OCELOT -
EXYS7950 KONDRA
Detect it if it's exploited
Until the patch is applied, Kondra monitors your network, events and endpoints in real time. It keeps an inventory of the software installed on every endpoint, and its anomaly detection rules flag what an attacker does once inside.
Learn more about EXYS7950 KONDRA
Assembled from the NVD 2.0 API, the CISA Known Exploited Vulnerabilities Catalog and FIRST EPSS. Scores are as of our last collection on 17 Oct 2026, not the live upstream state.