VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVReported exploited: VulnCheck KEV since Published CVSS 9.0 criticalEPSS 6.9% probability of exploitation in 30 days
Cisco

CVE-2025-20363: A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .

VulnCheck KEV lists it since . It cites 8 public reports, the first from .

How likely is exploitation in the next 30 days?
6.9%

EPSS score, percentile 94.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
9.0 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • 12.2(15)B
  • 12.2(16)B1
  • 12.2(16)B2
  • 12.2(16)B
  • 12.2(15)BC2a
  • 12.2(15)BC1a

and 54 more in the table below

Versions by product

Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Source: CVE List, as of . About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (5 products)
Cisco IOS
StatusVersions
Affected12.2(15)B
Affected12.2(16)B1
Affected12.2(16)B2
Affected12.2(16)B
Affected12.2(15)BC2a
Affected12.2(15)BC1a
Affected12.2(15)BC1b
Affected12.2(15)BC2d
Affected12.2(15)BC2g
Affected12.2(15)BC1g
Affected12.2(15)BC2i
Affected12.2(15)BC1c

And 1993 more version entries in the CVE record.

Cisco Cisco IOS XR Software
StatusVersions
Affected6.5.1
Affected6.5.2
Affected6.5.3
Affected6.6.2
Affected6.6.3
Affected6.6.25
Affected6.7.1
Affected6.7.2
Affected6.7.3
Affected6.8.1
Affected6.8.2
Affected6.9.1

And 1 more version entries in the CVE record.

Cisco Cisco Adaptive Security Appliance (ASA) Software
StatusVersions
Affected9.8.1
Affected9.8.1.5
Affected9.8.1.7
Affected9.8.2
Affected9.8.2.8
Affected9.8.2.14
Affected9.8.2.15
Affected9.8.2.17
Affected9.8.2.20
Affected9.8.2.24
Affected9.8.2.26
Affected9.8.2.28

And 208 more version entries in the CVE record.

Cisco Cisco IOS XE Software
StatusVersions
Affected3.2.0SG
Affected3.2.1SG
Affected3.2.2SG
Affected3.2.3SG
Affected3.2.4SG
Affected3.2.5SG
Affected3.2.6SG
Affected3.2.7SG
Affected3.2.8SG
Affected3.2.9SG
Affected3.2.10SG
Affected3.2.11SG

And 444 more version entries in the CVE record.

Cisco Cisco Firepower Threat Defense Software
StatusVersions
Affected6.2.3
Affected6.2.3.1
Affected6.2.3.2
Affected6.2.3.3
Affected6.2.3.4
Affected6.2.3.5
Affected6.2.3.6
Affected6.2.3.7
Affected6.2.3.8
Affected6.2.3.10
Affected6.2.3.11
Affected6.2.3.9

And 82 more version entries in the CVE record.

Source: CVE List, as of . About the data.

Weakness

CWE-122

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

1

Known exploited Cisco vulnerabilities

  • CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (added )
  • CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability (added )
  • CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (added )
  • CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (added )
  • CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability (added )