Is CVE-2025-20363 being actively exploited?

CVE-2025-20363 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2025-20363?

CVE-2025-20363 has a CVSS 3.1 base score of 9.0 (CRITICAL).

CVE-2025-20363

CRITICAL · CVSS 9.0EPSS 6.9%EU EUVD

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Key facts

CVSS score: 9.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-122
EPSS score: 6.9% (94th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2025-31138)
Published: September 25, 2025
NVD last modified: August 11, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-31138 in the EU Vulnerability Database. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

cisco / adaptive security appliance software
cisco / asr 9001
cisco / ios
cisco / ios xe
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / ios xr
cisco / secure firewall threat defense
cisco / secure firewall threat defense

Certified products that may be affected

33 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Embedded Services 9300 and 3300 Series Switches (ESS9300 & ESS3300) running IOS-XE 17.15 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11662-2026 - active
Cisco Catalyst 8000V Edge (C8000V) running IOS-XE 17.15 - Cisco Systems, Inc. - Common Criteria Certificate Number: 2025/161 - active
Cisco 1000 Series Integrated Services Routers (C1100), Cisco Catalyst IR1800 Rugged Series Routers (IR1800), Cisco Catalyst IR8300 Rugged Series Routers (IR8300) running IOS-XE 17.15 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11643-2025 - active
Cisco Catalyst Industrial Ethernet 9300 Rugged Series Switches running IOS-XE 17.15 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11603-2025 - active
Cisco Aggregation Services Router 1000 Series (ASR1K), Cisco Catalyst 8200, 8300, 8500 Series Edge Routers (Cat8K) running IOS-XE version 17.15 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11642-2025 - active

See all 33 in the Security Certifications Explorer.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain