Warnings about Cisco vulns under active exploit are falling on deaf ears

Nearly 50,000 Cisco ASA/FTD instances vulnerable to two bugs that are actively being exploited by "advanced" attackers remain exposed to the internet, according to Shadowserver data. The internet monitoring outfit said that as of Monday, the internet-facing Cisco firewalls are potentially exploitable, with the vast majority of those – more than 19,000 – located in the US. The vulnerabilities in question are CVE-2025-20333 (9.9) and CVE-2025-20362 (6.5), which affect Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices. National security agencies such as the UK's NCSC and its equivalents in Canada, France, and the Netherlands each issued separate advisories warning of the threat the vulnerabilities present to organizations. Register for The Register's Forums here. CISA issued a rare order to all federal civilian executive branch (FCEB) agencies to patch the vulnerabilities within 24 hours. When bugs like this are added to CISA's Known Exploited Vulnerability catalog, FCEB agencies are typically afforded a three-week window in order to apply patches. A 24-hour window is rare, but not unheard of, and is only used in cases where the likelihood of exploitation is especially high. CISA told all agencies that failing to patch affected devices would introduce an "unacceptable risk" to government systems. The vulnerabilities affect Cisco ASA software versions: 9.12, 9.14, 9.16 to 9.20, and 9.22 to 9.23. They also affect ASA and FTD versions 7.0 to 7.4, ...