DaystoPatch

CiscoExploited incident

Cisco Secure Firewall ASA and FTD VPN web server zero-days (ArcaneDoor: CVE-2025-20333 and CVE-2025-20362)

CVE-2025-20333, CVE-2025-20362Critical, CVSS 9.9In CISA's Known Exploited Vulnerabilities catalog since 25 Sep 2025

  • Exploited before a fix
FixedFixed for every supported version same day after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-asaftd-webvpn-z5xP8EUBClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:640b072985c562c3…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    CISA KEV (CVE-2025-20333)ClaimedQuote verified25 Sep 2025

    Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-09-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-20362)ClaimedQuote verified25 Sep 2025

    Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

    Added to CISA's KEV catalog on 2025-09-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco Event Response: Continued Attacks Against Cisco Firewalls, Version 1 (Wayback snapshot 2025-09-25)CuratedQuote verified25 Sep 2025

    In May 2025, Cisco was engaged by multiple government agencies that provide incident response services to government organizations to support the investigation of attacks that were targeting certain Cisco Adaptive Security Appliance (ASA) 5500-X Series devices

    Page header 'Version 1: September 25, 2025'. Cisco attributes the activity with high confidence to the ArcaneDoor actor. The May 2025 engagement was private; this page is its first public disclosure. Quote verified against archived copy https://web.archive.org/web/20250925170438/https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25fd8ac03324b9e0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-asaftd-webvpn-YROOTUWClaimedQuote verified25 Sep 2025, 16:00 UTC

    attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:24cd230170cde1d3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-asaftd-webvpn-z5xP8EUB, v1.0 (Wayback snapshot 2025-09-25)CuratedQuote verified25 Sep 2025, 16:00 UTC

    The Cisco Product Security Incident Response Team (PSIRT) is aware of attempted exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

    Disclosed with fixes in v1.0 (First Published 2025 September 25 16:00 GMT), alongside the companion advisory cisco-sa-asaftd-webvpn-YROOTUW (CVE-2025-20362) and Cisco's event response page. CISA issued Emergency Directive ED 25-03 the same day.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10a6148b25a2a895…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-20333ClaimedQuote verified25 Sep 2025, 16:12 UTC

    A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:26253066c85cb4cc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Sep 2025, 16:30 UTC

    You can now share your thoughts on vulnerability CVE-2025-20333 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet25 Sep 2025, 17:14 UTC

    vulnerability. https:// thedefendopsdiaries.com/unders tanding-and-responding-to-cisco-asa-and-ftd-zero-day-vulnerabilities-cve-2025-20333-and-cve-2025-20362/ # cisco # zeroday # cybersecurity # vulnerabilities # cve202520333 # cve202520362

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-asaftd-webvpn-z5xP8EUBClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:640b072985c562c3…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Cisco advisory cisco-sa-asaftd-webvpn-YROOTUWClaimedQuote verified25 Sep 2025, 15:56 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6d1c5bd4d0989367…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-asaftd-webvpn-YROOTUWClaimedQuote verified25 Sep 2025, 16:00 UTC

    attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:24cd230170cde1d3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-asaftd-webvpn-z5xP8EUBCuratedQuote verified25 Sep 2025, 16:00 UTC

    First Published: 2025 September 25 16:00 GMT

    CSAF 1.0.0 at 2025-09-25T15:56:22+00:00; companion advisory cisco-sa-asaftd-webvpn-YROOTUW has the same First Published time.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:640b072985c562c3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-asaftd-webvpn-z5xP8EUB, v1.0 (Wayback snapshot 2025-09-25)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10a6148b25a2a895…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Cisco Event Response: Continued Attacks Against Cisco Firewalls, Version 1 (Wayback snapshot 2025-09-25)CuratedQuote verified25 Sep 2025

    The fixed release for Cisco Secure ASA Software Release 9.14 is 9.14.4.28.

    Same-day event page (Version 1: September 25, 2025, no time given) listing fixed releases; recorded at day precision alongside the advisory's 16:00 GMT timestamp. Quote verified against archived copy https://web.archive.org/web/20250925170438/https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25fd8ac03324b9e0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-asaftd-webvpn-z5xP8EUBClaimedQuote verified6 Nov 2025, 15:50 UTC

    Fixed the Cisco Software Checker template. Added information on first fixed releases for Cisco Secure Firewall ASA Software releases 9.12 and 9.14.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:640b072985c562c3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-asaftd-webvpn-YROOTUWClaimedQuote verified6 Nov 2025, 15:50 UTC

    Fixed the Cisco Software Checker template. Added information on first fixed releases for Cisco Secure Firewall ASA Software releases 9.12 and 9.14.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6d1c5bd4d0989367…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Cisco Event Response: Continued Attacks Against Cisco Firewalls, Version 1 (Wayback snapshot 2025-09-25)CuratedQuote verified

    The fixed release for Cisco Secure ASA Software Release 9.12 is 9.12.4.72.

    The Version 1 event page lists first fixed releases for every ASA train (9.16 through 9.23; older trains migrate) and FTD train, plus hidden releases 9.12.4.72 and 9.14.4.28 for end-of-support ASA 5500-X models. The advisories themselves only added the 9.12/9.14 note in revision 2.1 (CSAF 2025-11-06T15:50:54+00:00). Quote verified against archived copy https://web.archive.org/web/20250925170438/https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25fd8ac03324b9e0…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Cisco ASA and FTD firewall VPN zero-days exploited by ArcaneDoor actor

A state-linked group exploited two flaws in the VPN web server of Cisco ASA and FTD firewalls before fixes existed; Cisco published fixes on 25 September 2025 and later warned of a persistence mechanism that survives upgrades.

In plain words

Our Cisco firewalls' VPN feature had two flaws that a sophisticated, state-linked group used to take over firewalls before any fix existed. Cisco released fixes on 25 September 2025 and the US government ordered agencies to act immediately. In April 2026 investigators found the attackers can stay hidden even after the upgrade, so patching alone is not enough for devices that may have been exposed; they also need the deeper checks Cisco and CISA describe. Old ASA 5500-X hardware that is past its support date should be replaced.

What happened and who is affected

What happened

On 25 September 2025 Cisco disclosed CVE-2025-20333 (code execution as root for an attacker with VPN credentials, scored 9.9) and CVE-2025-20362 (unauthenticated access to restricted VPN URLs, 6.5), which attackers chained against Cisco firewalls; Cisco had been helping government agencies investigate the attacks since May 2025 and links them to the ArcaneDoor campaign. Fixed releases for all trains were published the same day and CISA issued an emergency directive. In November 2025 Cisco reported a new attack variant that crashes unpatched devices. In April 2026 CISA and Cisco warned that the actor has a persistence mechanism in the FXOS base operating system that survives upgrading to the September 2025 fixes.

Who is affected

Cisco Secure Firewall ASA and FTD software with the remote access VPN (WebVPN/AnyConnect/SSL VPN) web server enabled, on releases before the first fixed release for each train listed by Cisco (for example ASA 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19; FTD 7.0.8.1 and later trains); end-of-support ASA 5500-X models on 9.12 or 9.14 need the hidden releases 9.12.4.72 or 9.14.4.28.

CVE-2025-20333, CVE-2025-20362. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2025-20333/

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Secure Firewall Threat Defense (FTD) Software
How we built this timeline

Grouped: CVE-2025-20333 (cisco-sa-asaftd-webvpn-z5xP8EUB, CVSS 9.9) and CVE-2025-20362 (cisco-sa-asaftd-webvpn-YROOTUW, CVSS 6.5) were published together, chained in the same campaign per Cisco's event response page, and added to KEV the same day. A third CVE in the same release (CVE-2025-20363) is not in KEV.

Primary CVE is CVE-2025-20333 (highest CVSS). Later developments: revision 2.0 (CSAF 2025-11-05T20:56:03+00:00) added a new DoS attack variant against unpatched devices; event page update of 23 Apr 2026/24 reports an FXOS persistence mechanism 'preserved across upgrading to the fixed releases that were published in September 2025' and a wider set of targeted platforms; this does not change the patch moments but means the fix alone does not evict an existing intruder.

The fixed releases quoted in the brief come from the event response page's table.

Related

Cisco report card