Federal agencies (and organizations managing Cisco ASA/FTD firewalls) must inventory, patch, and report under CISA’s ED 25‑03: one vulnerability enables remote code execution; the other enables privilege escalation.