CISA KEV + NVD
Cisco ASA and Firepower flaws exploited in the wild
14 Cisco ASA and Firepower vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 14 exploited flaws, listed from 3 Nov 2021 to 11 Aug 2026
- 3 used in ransomware campaigns
- 2 scored critical by NVD
- 1 days: median gap between NVD publication and the KEV listing, leaving out the 3 listed on the catalog’s first day; 7 were listed within a week
All exploited Cisco ASA and Firepower flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 11 Aug 2026 | 11 Aug 2026same day or before NVD | 8.6 High | Vendor |
| CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 25 Sep 2025 | 25 Sep 2025same day or before NVD | 8.6 High | Vendor |
| CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 25 Sep 2025 | 25 Sep 2025same day or before NVD | 9.9 Critical | Vendor |
| CVE-2014-2120Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | Adaptive Security Appliance (ASA) | 19 Mar 2014 | 12 Nov 20243891 days later | 6.1 Medium | Vendor |
| CVE-2024-20481Cisco ASA and FTD Denial-of-Service Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 23 Oct 2024 | 24 Oct 20241 day later | 5.8 Medium | Vendor |
| CVE-2024-20359Cisco ASA and FTD Privilege Escalation Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 24 Apr 2024 | 24 Apr 2024same day or before NVD | 6.0 Medium | Vendor |
| CVE-2024-20353Cisco ASA and FTD Denial of Service Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 24 Apr 2024 | 24 Apr 2024same day or before NVD | 8.6 High | Vendor |
| CVE-2020-3259Cisco ASA and FTD Information Disclosure Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 6 May 2020 | 15 Feb 20241380 days laterUsed in ransomware | 7.5 High | Vendor |
| CVE-2023-20269Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | Adaptive Security Appliance and Firepower Threat Defense | 6 Sep 2023 | 13 Sep 20237 days laterUsed in ransomware | 9.1 Critical | Vendor |
| CVE-2016-6367Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability | Adaptive Security Appliance (ASA) | 18 Aug 2016 | 24 May 20222105 days later | 7.8 High | — |
| CVE-2016-6366Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability | Adaptive Security Appliance (ASA) | 18 Aug 2016 | 24 May 20222105 days later | 8.8 High | — |
| CVE-2020-3580Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 21 Oct 2020 | 3 Nov 2021378 days laterUsed in ransomware | 6.1 Medium | — |
| CVE-2020-3452Cisco ASA and FTD Read-Only Path Traversal Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 22 Jul 2020 | 3 Nov 2021469 days later | 7.5 High | — |
| CVE-2018-0296Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | Adaptive Security Appliance (ASA) | 7 Jun 2018 | 3 Nov 20211245 days later | 7.5 High | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.