HighCISA KEVExploited in the wildPublic exploit

Authentication Bypass in Cisco Secure ASA and FTD VPN Web Server

IdentifiersCVE-2025-20362CWE-20

CVE-2025-20362 is an authentication bypass vulnerability in the VPN web server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw is caused by improper validation of user-supplied input in HTTP(S) requests, with reporting also describing inadequate implementation of authentication checks around remote access VPN URL handling. A remote, unauthenticated attacker can send crafted HTTP(S) requests to the affected web server and reach restricted remote access VPN URL endpoints that should only be available after successful authentication. Cisco later reported a related attack variant against devices still unpatched for CVE-2025-20362 and CVE-2025-20333 that can force repeated device reloads, producing denial-of-service conditions. The vulnerability has been reported as actively exploited in the wild and has been used in intrusion chains against exposed Cisco firewall and VPN infrastructure.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthorized access to restricted VPN-related web resources without authentication. On its own, this can expose functionality and information intended only for authenticated users and can facilitate reconnaissance, session or workflow abuse, and follow-on exploitation. In observed real-world campaigns, CVE-2025-20362 was used as part of broader attack chains against Cisco ASA and FTD devices, contributing to initial access on perimeter security appliances. Cisco also reported a later attack variant affecting unpatched devices that can trigger repeated reloads and cause denial-of-service conditions.

Mitigation

If you can’t patch tonight, do this now.

Primary mitigation is prompt installation of Cisco’s fixed software releases. Where immediate patching is not possible, reduce exposure of the VPN web server by restricting access to WebVPN and related management surfaces to trusted networks, disabling affected remote access VPN functionality if operationally feasible, and increasing monitoring of HTTP(S) access to VPN endpoints and device behavior. Because unpatched devices were reported vulnerable to active exploitation and reload-based denial of service, exposed internet-facing instances should be prioritized. If compromise is suspected, preserve forensic evidence and follow vendor and government incident-response guidance rather than relying solely on a normal reboot.

Remediation

Patch, then assume compromise.

Upgrade Cisco Secure ASA Software and Cisco Secure FTD Software to Cisco’s fixed releases for CVE-2025-20362. Cisco strongly recommended that all customers move to the fixed software versions identified in its security advisory, particularly because exploitation in the wild and a later denial-of-service attack variant were reported. If compromise is suspected, patching alone may be insufficient to remove post-exploitation implants, so incident response and device integrity validation should accompany software updates.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 2 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Cisco SystemsAdaptive Security Applianceoperating_system

Cisco SystemsAdaptive Security Appliance Softwareoperating_system

Cisco SystemsFirepower 1000 Serieshardware

Cisco SystemsFirepower 2100 Serieshardware

Cisco SystemsFirepower 4100 Serieshardware

Cisco SystemsFirepower 9300 Serieshardware

Cisco SystemsFirepower Threat Defenseapplication

Cisco SystemsFirewall Threat Defenseapplication

Cisco SystemsSecure Firewall 1200 Serieshardware

Cisco SystemsSecure Firewall 3100 Serieshardware

Cisco SystemsSecure Firewall 4200 Serieshardware

Cisco SystemsSecure Firewall Adaptive Security Appliance Softwareapplication

Cisco SystemsSecure Firewall Asaapplication

Cisco SystemsSecure Firewall Asa Softwareapplication

Cisco SystemsSecure Firewall Ftd Softwareapplication

Cisco SystemsSecure Firewall Threat Defenseapplication

Cisco SystemsSecure Firewall Threat Defense Softwareapplication

Cisco SystemsSecure Ftdapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

286 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

286 SOURCESView more in app

cyber security newsNews

May 22, 2026

Russian Threat Groups Use RDP, VPN, Supply Chain Attacks, and Social Engineering for Initial Access

Cisco ASA/AnyConnect VPN vulnerability used for initial access into internal networks.

malware newsNews

May 22, 2026

From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence - Malware News - Malware Analysis, News and Indicators

A Cisco firewall and VPN zero-day vulnerability mentioned in references as part of the broader trend of edge-device exploitation.

microsoft security blogNews

May 22, 2026

From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence | Microsoft Security Blog

A Cisco firewall and VPN zero-day vulnerability referenced in related context about edge-device exploitation trends.

sdxcentral cybersecurityNews

May 12, 2026

Cisco to plug leaky legacy ware with Resilient Infrastructure service - SDxCentral

A privilege escalation vulnerability associated with attacks on Cisco infrastructure and linked to the ArcaneDoor campaign.

+46 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence33

Every observed campaign linking this CVE to a named adversary.

Associated malware49

Malware families riding this exploit, with evidence and IOCs.

Detection signatures3

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity143

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2025-20362

NVD

nvd.nist.gov/vuln/detail/CVE-2025-20362

MITRE CWE · CWE-20

cwe.mitre.org

Vendor Advisory

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW

Vendor Advisory

sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362

Authentication Bypass in Cisco Secure ASA and FTD VPN Web Server

IdentifiersCVE-2025-20362CWE-20