48+ Cisco Firewalls Hit by Actively Exploited 0-Day Vulnerability

Cisco says two serious vulnerabilities affecting its Adaptive Security Appliance (ASA) and Firepower Threat Defence (FTD) firewalls are being actively exploited, tracked as CVE-2025-20333 and CVE-2025-20362, with exploits already in the wild. According to Cisco security advisories, the issues allow remote code execution and other impacts on unpatched devices, and organisations are urged to patch immediately to 9.18.1.18 or later.

Shadowserver’s daily vulnerable HTTP report now includes a live list of ASA/FTD instances susceptible to these 0-day bugs, with 48,800+ vulnerable IPs recorded on 2025-09-29 and the United States topping the exposed-host list, followed by Germany, Brazil, India, and the United Kingdom. The report also notes notable counts of 5,200+ for Germany, 4,500+ for Brazil, 3,800+ for India, and 3,300+ for the United Kingdom.

Mitigation steps include restricting management access, hardening credentials, monitoring logs, and network segmentation to limit damage if a firewall is compromised.