CVE-2025-20333
Lets authenticated attackers execute arbitrary code on Cisco ASA and FTD firewalls
A vulnerability in the VPN web server of Cisco Secure Firewall ASA and FTD software allows an authenticated attacker to execute arbitrary code as root due to improper validation of HTTP requests. CISA reports active exploitation and added it to the known-exploited list. No official fix has been released in the record, but Cisco later patched a related zero-day.
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Updated 29 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 25 Sept; US agencies must fix by 26 Sept
SeveritycriticalCVSS 9.9 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No official fix is available from the record. Cisco has released patches for a related zero-day; apply them as soon as possible. Follow Cisco's security advisories for any recommended mitigations.
What happened
- 25 SeptCISA adds the vulnerability to its known-exploited list, requiring US federal agencies to fix by September 26, 2025.
- 29 OctCisco releases security updates to patch a zero-day (CVE-2026-76418) that attackers are actively exploiting to crash ASA and FTD firewalls.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2025-20333 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | critical 9.9 | 25 Sept | 71% |
Our reporting
29 OctCisco patches actively exploited zero-day allowing remote crash of VPN firewallsReported elsewhere
BleepingComputer · 29 OctNew Cisco firewall zero-day exploited to crash SSL VPN devices ↗The records
CISA known-exploited catalog ↗CVE-2025-20333 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works