CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

BOD 26-04 remediation window

With CISA's SSVC answers for this CVE (automatable: yes, technical impact: partial), BOD 26-04 Table 1 gives 3 days on a publicly exposed asset (row 2) and 14 days on an asset that is not publicly exposed (row 10) ^S06. The catalogue due date, 1 days after the date added, was set before BOD 26-04 took effect on 10 June 2026 ^S06. The directive binds US federal civilian executive branch agencies only.

What CISA says

Short description

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Required action

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ; https://nvd.nist.gov/vuln/detail/CVE-2025-20362

CWE in the catalogue

CWE-862

Official links

• CISA KEV catalogue entry cisa.gov
• NVD record nvd.nist.gov

Vendor advisory and patch links

References NVD tags Vendor Advisory or Patch, exactly as NVD lists them.

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks Vendor Advisory

Links in CISA's notes

• https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
• https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions
• https://www.cisa.gov/eviction-strategies-tool/create-from-template
• https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
• https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
• https://nvd.nist.gov/vuln/detail/CVE-2025-20362

NVD details

CWE (NVD)

CWE-862 by psirt@cisco.com

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CVSS versions in NVD

V31

Last modified in NVD

2026-10-18T21:10:00.120

Where each value comes from

This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs. Methodology.