Is CVE-2025-20333 being actively exploited?

Yes. CVE-2025-20333 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 25, 2025.

What is the CVSS score for CVE-2025-20333?

CVE-2025-20333 has a CVSS 3.1 base score of 9.9 (CRITICAL).

CVE-2025-20333

CRITICAL · CVSS 9.9CISA KEV: actively exploitedEPSS 71.2%EU EUVD: exploited

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Key facts

CVSS score: 9.9 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-120
EPSS score: 71.2% (99th percentile)
In CISA KEV: Yes, added September 25, 2025
In EU EUVD: Yes (EUVD-2025-31140)
Published: September 25, 2025
NVD last modified: August 11, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Added to the KEV catalog on September 25, 2025; federal remediation due September 26, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-31140 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

cisco / adaptive security appliance software
cisco / secure firewall threat defense
cisco / secure firewall threat defense

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Secure Firewall Threat Defense (FTD) 7.4 with Secure Firewall Management Center (FMC) 7.4 and Secure Client 5.1 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400046-01-CR - active
Cisco Secure Firewall Threat Defense Virtual 7.4 with FMC/FMCv - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11510-2025 - active

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB(Vendor Advisory)
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain