Cisco ASA and FTD Firewall RCE

A sophisticated espionage campaign is actively exploiting critical zero-day vulnerabilities in Cisco Secure Firewall ASA and FTD (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) to achieve unauthenticated remote code execution and ROM-level persistence; activity is attributed to an advanced actor tracked as ArcaneDoor (UAT4356/Storm-1849), has triggered CISA Emergency Directive ED 25-03, and organizations are urged to follow vendor advisories and mitigation guidance immediately.