Servers and applications
CVE-2025-20362
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed…
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Sept 2025.
- Severity
- High 8.6
- Published
- 25 Sept 2025
- Last changed
- 18 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Cisco ASA and Firepower Threat DefenseServers and applications · cpe:o:cisco:adaptive_security_appliance_software |
All 7 release lines
|
Known exploited
- CISA name
- Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
- Required action
- The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s…
- Due for US agencies
- 26 Sept 2025
- Used in ransomware
- Not known