CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Patch now

MEDIUM 6.5EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2025-20362 is a medium-severity flaw (CVSS 6.5) affecting adaptive security appliance software, secure firewall threat defense, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [

Why this priority

EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	87.1% (top 1%)
CISA exploited list	Yes, fix due 2025-09-26
Weakness	CWE-862
Published	2025-09-25
Last modified	2026-10-18

Publisher (CNA): Cisco Systems, Inc. · Vendor: cisco

Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-09-25Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-09-25 16:15 UTCPublished CVE record published
2025-09-26Deadline CISA due date for US federal agencies to patch
2026-10-18 21:10 UTCUpdated Record last modified

cisco adaptive security appliance software UPGRADE

Affected: >= 9.12 and < 9.12.4.72 · >= 9.14 and < 9.14.4.28 · >= 9.16 and < 9.16.4.85 · >= 9.17.0 and < 9.18.4.67 · >= 9.19 and < 9.20.4.10 · >= 9.22 and < 9.22.2.14 · >= 9.23 and < 9.23.1.19

Fixed in: 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19

Safe to downgrade to: a release before 9.12

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

cisco secure firewall threat defense UPGRADE

Affected: >= 7.0.0 and < 7.0.8.1 · >= 7.1.0 and < 7.2.10.2 · >= 7.3.0 and < 7.4.2.4 · >= 7.6.0 and < 7.6.2.1 · >= 7.7.0 and < 7.7.10.1

Fixed in: 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1

Safe to downgrade to: a release before 7.0.0

1. Check installed version

apt-cache policy secure-firewall-threat-defense || rpm -q secure-firewall-threat-defense || secure-firewall-threat-defense --version

2. UPGRADE to 7.0.8.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade secure-firewall-threat-defense

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade secure-firewall-threat-defense

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)

apt-cache madison secure-firewall-threat-defense sudo apt install secure-firewall-threat-defense=<VERSION_BEFORE_7.0.0> sudo apt-mark hold secure-firewall-threat-defense

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list secure-firewall-threat-defense sudo dnf downgrade secure-firewall-threat-defense-<VERSION_BEFORE_7.0.0> sudo dnf versionlock add secure-firewall-threat-defense

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · wordpress · FIXED · 7.1.4-1.fc46 · FEDORA-2026-907394725e · source

sudo dnf upgrade --advisory=FEDORA-2026-907394725e

Fedora ELN · rhc · FIXED · 0.3.15-1.eln159 · FEDORA-2026-1cd9f35750 · source

sudo dnf upgrade --advisory=FEDORA-2026-1cd9f35750

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: curtishoughton/CVE-2025-20362-Cisco-Scanner (1 stars)
Nuclei scan template: Cisco Secure Firewall ASA & FTD - Authentication Bypass

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-20362?

adaptive security appliance software: upgrade to 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19; secure firewall threat defense: upgrade to 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1. Exact commands for each OS are on this page.

Is CVE-2025-20362 being exploited?

Yes. CVE-2025-20362 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-20362 affect?

CVE-2025-20362 affects adaptive security appliance software, secure firewall threat defense. Severity is medium (CVSS 6.5). Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause un

How urgent is CVE-2025-20362?

Priority 78/100. EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Remotely exploitable, no login, no user action

Software pages

Cisco ASA vulnerabilities · Cisco vulnerabilities

Related CVEs

CVE-2026-76418 HIGH 8.6 EXPLOITED UPGRADE UPGRADE Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
CVE-2026-20349 HIGH 8.6 EXPLOITED MITIGATE DOWNGRADE Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
CVE-2025-20333 CRITICAL 9.9 EXPLOITED UPGRADE UPGRADE Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
CVE-2025-20363 CRITICAL 9.0 MITIGATE UPGRADE A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco
CVE-2025-20224 MEDIUM 5.8 DOWNGRADE MITIGATE A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Securi

References

← Back to latest CVEs