Yes. CISA added CVE-2024-20359 to its Known Exploited Vulnerabilities catalogue on 24 April 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
What this means operationally for Cisco ASA and FTD owners
For operators of Cisco ASA and Firepower Threat Defense, the practical question is not only whether the CVE exists, but whether any device is exposed in a way that makes exploitation plausible. Start by inventorying every ASA and FTD instance, confirm which are internet-facing or otherwise reachable by untrusted users, and treat unmanaged remote access paths as high priority until they are verified and constrained.
Because this issue is already in CISA’s KEV catalogue, the control objective is exposure reduction rather than theoretical vulnerability tracking. For edge devices, that usually means verifying administrative reachability, checking whether local privilege boundaries are already hardened, and ensuring logging is sufficient to show whether a device was touched before remediation.
Where a network appliance supports management access from broad trust zones, privilege escalation flaws become much easier to operationalise. That is why NHIMG’s Edge Device Security Guide is relevant here: the same appliance hardening, management exposure, and logging minimums that matter for routers and gateways also matter for ASA and FTD.
Why KEV status changes the response priority
CISA listing means the vulnerability is not just a lab finding or a low-probability issue. In practice, KEV status should move the item ahead of ordinary backlog work and into the same response lane as other actively exploited weaknesses, especially when the affected platform sits at a network boundary or supports remote administration.
The key practitioner implication is that patch timing should be based on exposure and business criticality, not on whether the device has already shown obvious signs of compromise. For privileged network appliances, attackers often benefit from low-friction access to management paths, stale administrative practices, or insufficient segmentation between user traffic and admin control planes.
When an edge platform is under active exploitation pressure, a broader vulnerability process helps more than ad hoc patching. NHIMG’s Vulnerability Management Guide is useful for prioritising KEV-listed issues, setting remediation urgency, and tracking exception handling and verification for devices that cannot be touched immediately.
What to do if patching must wait
If immediate remediation is not possible, reduce the attack surface around the appliance first. That means tightening who can reach management interfaces, removing unnecessary admin exposure, reviewing local administrative accounts, and validating that logging and alerting are capturing privileged events that would reveal abnormal behaviour early.
For Cisco ASA and FTD specifically, the concern is not abstract disclosure but privilege gain on a device that often sits close to sensitive traffic flows. If the appliance cannot be patched quickly, the fallback should be a temporary compensating-control posture: constrain administrative access as much as possible, document the exception, and monitor for unusual configuration or authentication activity.
A useful comparison point is how other exploited Cisco-related weaknesses have been used to gain or extend control over network infrastructure. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is relevant because it frames the response pattern for actively exploited flaws: emergency mitigation, verification, and follow-up hunting when full remediation lags.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed flaws require rapid identification and prioritised remediation of exposed assets. |
| Recommendation — Prioritise and remediate actively exploited edge-device vulnerabilities on an urgent, asset-scoped schedule. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This is an actively exploited CVE, so exposure confirmation and monitoring are central. |
| SI-2 — Flaw Remediation | The issue requires timely flaw remediation once exploitation is confirmed by CISA KEV inclusion. | |
| AC-6 — Least Privilege | Privilege escalation becomes more damaging when administrative access is broadly available. | |
| Recommendation — Continuously scan and track ASA and FTD exposure to drive immediate remediation decisions. Apply and verify remediation for affected appliances as soon as operationally feasible. Restrict administrative privileges and management reachability on ASA and FTD devices. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | KEV status turns the flaw into a live technical vulnerability requiring governed treatment. |
| Recommendation — Track, prioritise and remediate the vulnerability through a formal technical-vulnerability process. | ||
Practitioner Guidance
What to prioritise: Confirm whether any ASA or FTD instance is externally reachable, whether admin access is tightly bounded, and whether the device is covered by a documented remediation owner and timeline. If it is internet-facing or used for remote administration, treat it as urgent.
What to verify: Check for evidence of prior tampering, unexpected privilege changes, new local accounts, altered configuration, and gaps in logs around the period when the device may have been exposed. A clean patch state is not enough if the device cannot prove its own recent integrity.
Practitioner takeaway: For KEV-listed edge-device flaws, the real decision is whether you can prove the appliance was controlled before exploitation pressure became material, and whether you can keep it that way until remediation is complete.
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2024-20359 (Cisco ASA and FTD Privilege Escalation)?
- CVE-2024-20359 (Cisco ASA and FTD Privilege Escalation)
- Is CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service) being exploited in the wild?
- Is CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow) being exploited in the wild?