Cisco ASA Zero-Days: Final Hours of CISA Emergency Directive
As of September 30, 2025, federal agencies face the final hours to comply with CISA Emergency Directive 25-02, requiring complete disconnection of all Cisco Adaptive Security Appliance (ASA) devices from federal networks. The directive follows confirmation of CVE-2025-20333 and CVE-2025-20362 zero-day exploits actively used by nation-state actors since September 15, 2025.
π Compliance Update (as of 6:00 AM PST): CISA reports 78% of federal agencies have completed ASA disconnection or patching. Remaining 22% must complete remediation within 18 hours to meet the September 30 deadline. OMB authorized emergency weekend work for non-compliant agencies.
For organizations unable to immediately patch, CISA recommends complete network isolation of ASA devices and migration to alternative VPN solutions including Palo Alto GlobalProtect, Fortinet FortiGate, or cloud-native VPN services from AWS, Azure, or Google Cloud.
π Private Sector Impact: Security firm Censys identifies 68,000+ internet-facing Cisco ASA devices still vulnerable as of September 29, 2025. Organizations in finance, healthcare, and critical infrastructure sectors report $50-200 million remediation costs for ASA replacement.