CISA directs federal agencies to urgently patch Cisco firewall vulnerabilities amid ongoing attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent emergency directive ordering all federal civilian agencies to immediately patch critical vulnerabilities in Cisco firewall devices amid an ongoing, sophisticated hacking campaign actively exploiting these flaws. The directive, issued on September 25, 2025, mandates that agencies either patch or disconnect vulnerable Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices by September 26 at 11:59 p.m. to prevent further compromise[2][6][8].

These vulnerabilities are zero-day exploits with severity sc...

These vulnerabilities are zero-day exploits with severity scores as high as 9.9, enabling attackers to maintain persistence on devices through reboots and system upgrades, disable logging, and evade detection. The hacking campaign, linked to a state-sponsored group known as ArcaneDoor, has been ongoing since November 2023, targeting U.S. government networks to conduct espionage and network intrusions[2][6].

CISA’s emergency directive (ED 25-03) requires agencies to:

- Identify and inventory all Cisco firewall devices within s...

- Identify and inventory all Cisco firewall devices within scope on their networks. - Apply patches provided by Cisco to remediate the zero-day vulnerabilities. - Disconnect any devices that have reached end-of-support or cannot be patched immediately. - Conduct forensic analysis using CISA’s threat hunting tools and procedures to detect any signs of compromise. - Report back to CISA by October 3 with details on actions taken and device status[6][8].

Cisco has confirmed multiple variants of these attacks, incl...

Cisco has confirmed multiple variants of these attacks, including a new wave discovered in early November 2025, highlighting the advanced nature and persistence of the threat actor. The vulnerabilities specifically affect Cisco’s Secure ASA and Secure FTD software platforms, which are widely used for network perimeter defense in federal and private sectors[5][7].

Madhu Gottumukkala, acting director of CISA, emphasized the...

Madhu Gottumukkala, acting director of CISA, emphasized the criticality of the situation, stating that the ease with which attackers exploit these vulnerabilities poses a significant risk to victim networks and underscores the urgency of immediate patching efforts[6].

While the emergency directive legally applies only to federa...

While the emergency directive legally applies only to federal civilian executive branch agencies, CISA strongly encourages other government entities and private organizations using Cisco firewalls to follow the same guidance to mitigate risks[2].

This directive comes amid concerns that some federal agencie...

This directive comes amid concerns that some federal agencies have not yet fully patched their vulnerable Cisco devices despite the ongoing active exploitation, raising alarms about the potential for further breaches and data theft within U.S. government networks[3][9].

In summary, CISA’s urgent order highlights an escalating cyb...

In summary, CISA’s urgent order highlights an escalating cybersecurity threat targeting critical firewall infrastructure, demanding swift federal action to safeguard sensitive government systems from sophisticated espionage campaigns exploiting unpatched Cisco firewall vulnerabilities.