Cisco ASA 0-Day RCE Flaw Actively Exploited in the Wild

A critical zero-day vulnerability in Cisco Secure Firewall ASA and FTD software is being actively exploited in the wild, tracked as CVE-2025-20333 and enabling an authenticated attacker to execute arbitrary code as root on affected devices. Cisco published an advisory on 25 September 2025 urging users to upgrade to a fixed software release, with no workaround available.

The flaw stems from improper validation of user-supplied input in HTTP(S) requests and was identified in the VPN web server component; Cisco PSIRT is tracking active exploitation attempts and emphasises rapid patching. In addition to the critical RCE, the advisory notes a medium-severity flaw, CVE-2025-20362, which permits unauthenticated access to certain URL endpoints without proper checks and could aid further attacks.

Affected devices include any ASA or FTD system running a vulnerable release with webvpn or AnyConnect IKEv2 remote access enabled, and specific configurations that open SSL listen sockets are at risk, according to Cisco. Users are urged to upgrade to the fixed software release as soon as possible, and to review threat detection settings for VPN services after updating, according to Cisco.