Urgent: Cisco ASA Zero-Day Duo Under Attack; CISA Triggers Emergency Mitigation Directive

Cisco has disclosed two zero-day flaws in the VPN web server of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defence (FTD) Software, which are being exploited in the wild. The vulnerabilities are CVE-2025-20333 (CVSS 9.9) which could allow an authenticated remote attacker with VPN credentials to run arbitrary code as root, and CVE-2025-20362 (CVSS 6.5) which could let an unauthenticated attacker access restricted URL endpoints by crafting HTTP requests.

Cisco said it is aware of attempted exploitation of both flaws and that the two vulnerabilities appear to be chained to bypass authentication and execute malicious code on affected devices. CISA has issued Emergency Directive ED 25-03, urging federal agencies to identify and mitigate potential compromises with immediate effect, and both vulnerabilities have been added to the Known Exploited Vulnerabilities catalog, giving agencies 24 hours to apply mitigations.

The agency notes an ongoing exploitation campaign by an advanced threat actor targeting Cisco ASA, linked to a threat cluster named ArcaneDoor and attributed to a threat actor dubbed UAT4356 (aka Storm-1849), with ROM manipulation to persist through reboot and system upgrade. The investigation has been supported by the Australian Signals Directorate, ACSC, Canadian Centre for Cyber Security, and the U.K. National Cyber Security Centre, among others.