CVE-2025-20333
Exploited in the wild. In CISA KEV since 2025‑09‑25. A vendor fix is available.
What to do
The vendor has published a fix. Version details are below where the sources state them.
What it is
From the CVE record
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Listed as exploited in the wild since 2025-09-25.
US federal agencies must remediate by 2025-09-26.
The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Public exploits
0 sources with a proof of concept or module.
Exploit links, PoCs and Metasploit modules after sign-in- EPSS
71% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
12 events over 333 days, from the signal feeds we watch.
- EPSS band changemoderate → highepss band change
- Analysis publishedThe Firewall Crash Bug Cisco Has Now Shipped Twice: CVE-2026-20349 and Its 2024 Twin
- Patch availablerecord updated
- OpenVAS check added
- Patch availablerecord updated
- Added to CISA KEVpublished, weakness classified, att&ck mapped
Affected products
- adaptive security appliance softwareNetworking Infrastructure
- secure firewall threat defenseNetworking Infrastructure / router-switch
- Firepower Threat DefenseNetworking Infrastructure
- Adaptive Security ApplianceNetworking Infrastructure
- Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareNetworking Infrastructure
- Cisco Secure Firewall Threat Defense (FTD) SoftwareNetworking Infrastructure
Technical detail
CVSS 3.1 vector
Open in the CVSS calculatorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Scored 9.9 by NVD.
How it is reached
- Attack Vector NetworkExploitable remotely over the network without any special conditions
- Attack Complexity LowNo special conditions — the attack can be reliably reproduced
- Privileges Required LowRequires basic user-level privileges
- User Interaction NoneNo user interaction needed — fully automated exploitation
Scope
- Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)
Impact if exploited
- Confidentiality HighTotal information disclosure — all data in the component is compromised
- Integrity HighTotal loss of integrity — attacker can modify any data in the component
- Availability HighTotal denial of service — the component is completely unavailable
Weaknesses
ATT&CK techniques
Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.
- Initial AccessT1190Exploit Public-Facing Applicationhigh confidence
- Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence
Sources
References in the record
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Cisco, not every advisory. This one: actively exploited.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI