CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
Affected products
cisco: adaptive security appliance software; cisco: asa 5500; cisco: asa 5500-x; cisco: asa 5500 csc-ssm; cisco: asa 5505; cisco: asa 5506-x; cisco: asa 5506h-x; cisco: asa 5506w-x; cisco: asa 5508-x; cisco: asa 5510; cisco: asa 5512-x; cisco: asa 5515-x; cisco: asa 5516-x; cisco: asa 5520; cisco: asa 5525-x
References10
- blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/c… Vendor Advisory
- tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
- blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/c… Vendor Advisory
- tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
- github.com/offensive-security/exploit-database-bin-sploits/raw/… Broken LinkExploit
- github.com/offensive-security/exploit-database-bin-sploits/raw/… Broken LinkExploit
- www.securityfocus.com/bid/92520 Broken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1036636 Broken LinkThird Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 23% percentile: 98 · as of 8 November 2026
- CWE
- CWE-77
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.