Feds Isolate Cisco Firewalls to Defend Against ‘Arcane Door’

The Cybersecurity and Infrastructure Security Agency is warning that a hacking campaign targeting Cisco firewalls exploits zero-day vulnerabilities that persist through reboots and system upgrades.

See Also: OnDemand Webinar | Trends, Threats and Expert Takeaways: 2025 Global IR Report Insights

The U.S. cyber defense agency published an emergency directive Thursday ordering federal agencies to disconnect unsupported devices and assess for compromise after uncovering a widespread hacking campaign, dubbed “Arcane Door,” targeting Cisco’s adaptive security appliances.

Cisco previously released multiple patches in April 2024 – two for critical vulnerabilities- after confirming that hackers had embedded malware in its adaptive security appliances and firepower threat defense software (see: Cisco Fixes Firewall 0-Days After Likely Nation-State Hack).

“The risks apply to any organization using these devices,” Chris Butera, acting executive assistant director for CISA’s cybersecurity division, told reporters Thursday afternoon. He said CISA is aware of “hundreds” of affected devices across the federal government and is “working closely” with Cisco to assess the full scope. The agency declined to name a specific nation-state or adversary behind the attack.

Agency officials said the campaign likely affects critical infrastructure sectors and urged operators to conduct security assessments and report any findings to CISA. Federal civilian executive branch agencies have until Friday, Sept. 26 to disconnect unsupported devices and upgrade those that will remain in use.

Though the emergency directive – only the second issued under the second Trump administration – applies solely to federal civilian agencies, CISA Acting Director Madhu Gottumukkala said the agency strongly urges “all entities to adopt the actions” outlined in the guidance.

The campaign exploits two zero-day vulnerabilities, with one enabling remote code execution and the other allowing privilege escalation. After disconnecting or updating vulnerable systems by Friday, agencies must then identify all in-scope devices, collect forensic data and report inventories by Oct. 2.