CISCO Security Advisory
Published Date: April 24, 2026
CVE: CVE-2025-20333
Advisory Summary
๐ก๏ธ ๐๐ซ๐จ๐ฐ๐ข๐ง๐ ๐๐๐ซ๐ฌ๐ข๐ฌ๐ญ๐๐ง๐๐ ๐ญ๐ก๐ซ๐๐๐ญ ๐๐ซ๐จ๐ฆ ๐๐ซ๐๐๐ง๐๐๐จ๐จ๐ซ ๐๐ ๐๐ข๐ง๐ฌ๐ญ ๐๐ข๐ฌ๐๐จ ๐๐๐๐ฎ๐ซ๐ ๐ ๐ข๐ซ๐๐ฐ๐๐ฅ๐ฅ ๐๐ฅ๐๐ญ๐๐จ๐ซ๐ฆ๐ฌ
Cisco has announced a critical update following the U.S. Cybersecurity and Infrastructure Security Agencyโs (CISA) latest directive on continuing threats to Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) products. The key issue stems from the ArcaneDoor threat actor, who has engineered an advanced persistence mechanism embedded deep within the Cisco Firepower eXtensible Operating System (FXOS). Unlike typical exploits, this persistence technique remains intact even after applying the security patches released in September 2025.
This development underscores the sophistication of ongoing attacks that began by exploiting two notable vulnerabilities prior to the patches:
- CVE-2025-20333: Remote Code Execution in the VPN Web Server
- CVE-2025-20362: Unauthorized Access in the VPN Web Server
The persistence embedded in the FXOS base operating system signals a concerning foothold for attackers, requiring vigilant monitoring and additional defensive strategies beyond conventional patching.
For network security professionals and infrastructure managers, this calls for renewed emphasis on detection capabilities around Cisco firewall platforms, comprehensive incident response planning, and swift application of Ciscoโs mitigations. Detailed guidance and technical resources remain available through Cisco’s dedicated response page.
โ ๏ธ ๐๐ฅ๐๐ซ๐ญ: Organizations using Cisco Firepower ASA and FTD devices should verify their firmware versions and proactively implement Cisco’s recommendations to mitigate long-term risks from this persistent threat.
Reference: Vendor Advisory