Cisco Confirms Active Exploitation of Secure ASA and FTD RCE Vulnerability

Cisco has issued a critical warning that ongoing attacks are targeting a severe remote code execution vulnerability affecting its Secure Firewall ASA Software and Secure Firewall FTD Software, with threat actors having developed a new attack variant to fully compromise unpatched devices. The vulnerability, tracked as CVE-2025-20333, affects the VPN web server component and is rated 9.9 on CVSS v3.1, with the weakness classified as a Buffer Overflow (CWE-120).

An authenticated remote attacker can exploit improper input validation in HTTP requests to gain root privileges, potentially allowing attackers to bypass security controls or modify firewall rules. Cisco became aware of the new variant in early November 2025 and notes that it can cause unpatched devices to reload, creating denial-of-service conditions that disrupt network operations.

The company has released fixed software versions and, according to Cisco Security Advisory, recommends all customers upgrade immediately since no workarounds are available. Organisations can use Cisco’s Software Checker to verify exposure and identify the earliest fixed versions, and Cisco also advises reviewing VPN threat-detection configurations after patching.