Incident · Resolved

Cisco ASA Zero-Day Attacks

Cisco ASA / Firepower Threat Defense · 2 stories since SEP 25

2: stories
2: CVEs
APR 26: latest

Vendor: Cisco
Product: ASA / Firepower Threat Defense
First reported: Sep 25, 2025
Latest: Apr 26, 2026

CVE-2025-20333 CVE-2025-20362On CISA KEV

The story so far

In September 2025, Cisco disclosed two zero days in its Adaptive Security Appliance software, CVE-2025-20333 and CVE-2025-20362, which an APT group Talos tracks as UAT4356 (the actor behind ArcaneDoor) was exploiting to run code and modify the devices’ ROM. CISA issued an emergency directive the same day. In April 2026 it updated that directive after the discovery of Firestarter, a backdoor the attackers used to stay on Cisco Firepower and Secure Firewall devices.

Written by the editors

Timeline · 2 stories

Oldest first ↓

SEP 25
IntrusionsCisco Warns of Attacks on Two ASA FlawsCisco’s Talos threat intelligence team said this campaign is the work of an actor it tracks as UAT4356, an APT team that has previously targeted ASA devices.DENNIS FISHER · 3 MIN
APR 26
PolicyFirestarter Malware Sparks Updated CISA Emergency DirectiveCISA is warning of a persistent backdoor called Firestarter that’s being used in attacks against Cisco Firepower and Secure Firewall products.LINDSEY O'DONNELL-WELCH · 4 MIN

Cisco ASA Zero-Day Attacks

The story so far

The Decipher Brief