Threat Insights: Active Exploitation of Cisco ASA Zero Days

According to Cisco, a sophisticated state-sponsored threat actor is actively exploiting three zero-day vulnerabilities in Cisco ASA and FTD software, targeting government networks worldwide for data exfiltration. The campaign involves CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363, with two of them under active exploitation and the third at high risk of imminent exploitation, as of 25 September 2025.

Cisco identifies the threat actor from a prior campaign named ArcaneDoor, and notes that attackers are using advanced evasion techniques to avoid logging and detection. The vulnerabilities could allow attackers to execute arbitrary code, exfiltrate data and implant persistent malware, even surviving device reboots. The U.S. Cybersecurity and Infrastructure Security Agency has issued Emergency Directive ED 25-03 mandating immediate mitigation for federal agencies, while the U.K.

National Cyber Security Centre published a malware analysis report on RayInitiator and LINE VIPER used in the attacks. Palo Alto Networks’ Unit 42 urges organisations to patch promptly and includes guidance and advisories for defence and detection.