Historical catalog analysis: CISA added this entry on September 25, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-20362 is a missing authorization vulnerability (CWE-862) affecting the VPN Web Server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. This flaw could potentially be chained with another vulnerability, CVE-2025-20333, to increase the impact on the affected system.
Exposure and applicability
This vulnerability is particularly relevant to U.S. healthcare providers and business associates who rely on Cisco ASA or FTD appliances to facilitate secure remote access for clinicians, administrative staff, and third-party vendors. Because these appliances often serve as the primary perimeter gateway to internal networks containing electronic Protected Health Information (ePHI), a failure in authorization at this layer could jeopardize the confidentiality and integrity of patient data.
On September 25, 2025, CISA added CVE-2025-20362 to its Known Exploited Vulnerabilities (KEV) catalog, indicating that the flaw has been observed in active exploitation. While CISA established a remediation deadline of September 26, 2025, this specific date applies to Federal Civilian Executive Branch (FCEB) agencies and is not a legal mandate for private healthcare entities, though it serves as a critical indicator of urgency.
Remediation priorities
Based on our analysis, healthcare security leaders should prioritize the following actions to reduce the likelihood of unauthorized network entry:
- Immediate Version Audit: Network administrators should identify all ASA and FTD instances currently in production. This is a prerequisite for applying any vendor-supplied patches or mitigations.
- Apply Vendor Patches: Prioritize the deployment of software updates provided by Cisco to address the missing authorization flaw. This is the primary control intended to prevent initial access via this specific vector.
- Implement CISA Mitigation Guidance: In environments where immediate patching is not feasible due to clinical uptime requirements, administrators should review and apply the mitigation steps outlined in CISA’s Emergency Directive 25-03.
- Conduct Compromise Assessment: Because this vulnerability has been exploited in the wild, security teams should follow the “hunt” instructions provided by Cisco and CISA to determine if unauthorized access has already occurred. This is a detection and recovery control rather than a prevention control.
How to validate remediation
To verify that exposure has been reduced, organizations should employ the following methods:
* Version Verification: Confirm through the device management console that the running software version matches the patched versions recommended by Cisco.
* Configuration Audit: Verify that any specific mitigation settings recommended in CISA’s guidance have been applied and are active across all perimeter gateways.
* Log Analysis: Review VPN access logs for anomalies consistent with the patterns described in the vendor’s hunt instructions to ensure no residual unauthorized sessions remain.
Limits and open questions
Patching and applying mitigations could reduce the likelihood of exploitation, but they do not guarantee absolute prevention against all attack vectors. It remains unknown whether this vulnerability has been utilized specifically in ransomware campaigns targeting healthcare. Furthermore, because this flaw can be chained with CVE-2025-20333, organizations must ensure that both vulnerabilities are addressed to fully mitigate the risk of a combined attack.
Source and editorial note
CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability · Source date: September 25, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: September 28, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 29, 2026 at 01:33 UTC.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗