Cisco's Wave of Actively Exploited Zero-Day Bugs Targets Firewalls, IOS

Cisco has disclosed four actively exploited zero‑day flaws affecting millions of devices, including three tied to a state‑sponsored actor behind the ArcaneDoor cyberespionage campaigns. According to CISA, the attacks exploit zero‑day vulnerabilities to gain unauthenticated remote code execution on ASAs and to manipulate ROM to persist after reboot and upgrades, with one notable SNMP‑related flaw affecting IOS and IOS XE that can allow authenticated RCE and DoS.

The directive names CVE‑2025‑20333 (CVSS 9.9), CVE‑2025‑20363 (CVSS 9.0) and CVE‑2025‑20362 (CVSS 6.5) as part of the ongoing campaign, and CVE‑2025‑20352 (CVSS 7.7) for the SNMP subsystem. Dustin Childs of Trend Micro’s Zero Day Initiative is cited as estimating at least 2 million boxes at risk from CVE‑2025‑20352. Cisco urged customers to upgrade to fixed releases, including IOS XE 17.15.4a, or to apply the advised mitigations, and noted that many affected devices are end of life.

The guidance underscores that patching is urgent given the wide footprint of Cisco devices across enterprises and the potential for high‑impact exploitation.