Hackers Exploit Cisco Firewall Vulnerabilities Sparking Global Cybersecurity Alarm

Summary

• Critical vulnerabilities in Cisco’s firewall software are being exploited.
• Exploitation of these flaws can give attackers control of affected devices.
• Global implications follow because Cisco firewalls are widely used by businesses and governments.
• Response measures include Cisco patches and an emergency directive from CISA.
• The urgent need is to patch and check devices for signs of compromise.

Why this matters

Cisco firewall vulnerabilities matter because widely deployed network gear can turn a single disclosure into a broad enterprise patching and exposure-management problem almost overnight. Incidents like this are reminders that perimeter devices are still high-value targets and that response speed matters as much as architecture.

What Cisco disclosed

The technical details

Cisco disclosed in late September 2025 that attackers were exploiting vulnerabilities in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The two flaws used in the attacks are CVE-2025-20333, which allows remote code execution, and CVE-2025-20362, which allows unauthenticated access to restricted URLs. Chained together, they can give an attacker full control of a vulnerable device.

A global problem

Cisco firewalls protect networks for businesses and governments. Compromise one and you sit at the network edge. That is why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to find and fix affected devices under an emergency directive.

The response

What Cisco recommends

Cisco has released fixed software and urges all ASA and FTD customers to upgrade immediately. It also recommends stronger monitoring and multi-factor authentication for remote access.

Industry reaction

Cisco tied the attacks to the same threat actor behind the earlier ArcaneDoor campaign against its firewalls. Repeat targeting of the same product line has security teams rethinking how they monitor edge devices.

Patch and hunt

Check and patch now

Patch first, then check. Every ASA and FTD device needs Cisco’s fixes, followed by CISA’s steps for collecting evidence and checking for compromise; anything past end of support should be replaced rather than patched, because it won’t get fixes at all.

What to watch

Expect more attacks on edge devices. Firewalls and VPN gateways face the internet and are often poorly watched.

Watch for further Cisco advisories and updates to CISA’s directive. Organizations that cannot patch quickly should consider taking exposed devices offline.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.