Is CVE-2025-20352 (Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-20352 to its Known Exploited Vulnerabilities catalogue on 29 September 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution.

What makes this a confirmed in-the-wild exploitation case?

The key signal is CISA’s inclusion of the vulnerability in the CISA Known Exploited Vulnerabilities Catalog, because KEV listings are reserved for vulnerabilities with reliable evidence of active exploitation. For practitioners, that changes the question from “should we patch eventually?” to “is this already being used against exposed Cisco infrastructure?”

Use the vendor advisory and the KEV entry together to confirm whether your IOS or IOS XE estate matches the affected product path, then treat any internet-facing or broadly reachable device as exposure-worthy until proven otherwise. The practical issue is not the CVE label alone, but whether SNMP is enabled, reachable, and deployed on devices that should not be accepting unsolicited management traffic.

Directly relevant operational evidence is not limited to patch status. Review management-plane access, SNMP configuration, and device logging for signs that the subsystem has been touched in abnormal ways, especially on routers and appliances that expose administrative services to untrusted networks. The Edge Device Security Guide is useful here because this class of vulnerability is easiest to exploit when device hardening, management exposure, and log coverage are weak.

Why Cisco IOS and IOS XE SNMP flaws are dangerous when exploitation is active

A stack-based buffer overflow in a management protocol subsystem is high-risk because it targets a service that is often trusted, persistent, and reachable across large administrative footprints. If the vulnerable SNMP service is exposed, an attacker may be able to crash the device for denial of service or attempt code execution, which can turn a network control point into an attacker foothold.

That matters more on edge and core devices than on ordinary endpoints because compromise can affect routing, remote administration, telemetry, and downstream availability at once. The blast radius can be larger than the initial vulnerability suggests, especially when the device also serves as a path to other trusted systems or is relied on for segmentation and traffic control.

From a response standpoint, the relevant comparison is not just patched versus unpatched, but exposed versus constrained. A device with management services reachable from untrusted networks is materially more urgent than a device with SNMP disabled, isolated, or tightly filtered, even before you know whether exploitation has already occurred.

How to validate exposure, mitigate fast, and look for compromise

First confirm whether the affected Cisco estate exists anywhere in your environment, including branch, campus, and remote-site devices that may be forgotten in inventory. Then verify whether SNMP is enabled, whether it is restricted to intended management sources, and whether the device can be patched or mitigated immediately using the vendor’s guidance and the KEV record.

If patching must wait, reduce exposure aggressively by constraining management access, disabling unnecessary SNMP exposure, and monitoring for abnormal device behavior. For an actively exploited flaw, compensating controls are only acceptable if they materially narrow the reachable attack surface and are actually enforced on the live management plane, not just documented in a standard build guide.

Because this is an exploitation-in-the-wild case, also check for earlier compromise rather than assuming a patch alone restores trust. Validate uptime anomalies, unexpected reloads, configuration changes, unusual SNMP activity, and any sign that the device behaved like a crash, persistence, or remote execution target before remediation. The Zero-Day and Exploited Vulnerabilities Guide is a good fit for the triage mindset here.

Risk and Threat Considerations

Actively exploited network infrastructure flaws create a dual risk: immediate service disruption and the possibility of deeper control-plane compromise. When the affected component sits on the management path of a router or switch, attackers can use it either to destabilize service or to gain a durable position inside the network boundary.

Failure mechanism: A malformed SNMP request can trigger the buffer overflow, which may crash the process or permit code execution if the attacker succeeds in shaping the overflow. In practice, the exploitation path is most attractive where the device is reachable from untrusted networks and where monitoring cannot quickly distinguish normal administrative polling from abuse.

Impact: The result can be device outage, loss of management visibility, configuration tampering, or a foothold for follow-on actions against adjacent systems. In an edge or core role, that can translate into broader connectivity impact, degraded segmentation, and a harder recovery because the compromised system is also the control surface for the network itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potentially adverse events	Active exploitation requires continuous monitoring for abnormal network device behaviour and SNMP abuse.
	PR.AA-05 — Identities and credentials are managed, verified, and authenticated	SNMP exposure and management access hinge on authenticated administrative access paths.
Recommendation — Monitor network device and SNMP activity for abnormal events tied to exploitation. Restrict and verify administrative access to network devices.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification, prioritization, and remediation of exposed devices.
Recommendation — Prioritise and remediate exposed Cisco devices under continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed Cisco flaw calls for timely remediation and controlled handling of delayed patching.
	AU-6 — Audit Record Review, Analysis, and Reporting	Investigating exploited SNMP services depends on reviewing device logs and management activity.
Recommendation — Apply remediation promptly and track exceptions for any delayed Cisco patching. Review device audit records for signs of SNMP exploitation or follow-on activity.

Practitioner Guidance

What to prioritise: Treat KEV inclusion as an operational escalation trigger, not a research note. Your first priority is to identify every Cisco IOS and IOS XE device that could answer SNMP from an unintended network and move those devices into a verified remediation queue.

What to verify: Confirm three things before declaring the issue handled: the device is actually covered by the vendor advisory, the exposure path has been removed or reduced, and the device shows no signs of pre-remediation instability or suspicious management activity. If any of those three fail, keep it in an incident-response posture rather than a simple patching ticket.

Practitioner takeaway: For actively exploited infrastructure flaws, the correct unit of work is not just patching a CVE, it is restoring trust in the device’s management plane and proving the device was not already abused.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org