CISA orders patch for Cisco ASA/Firepower after cyber campaign

The U.S. Cybersecurity and Infrastructure Security Agency on Thursday ordered federal agencies to immediately patch Cisco firewall devices after an advanced hacking campaign exploited previously unknown vulnerabilities in Cisco Adaptive Security Appliance products. CISA said the activity is widespread, poses a significant risk to networks, and directed agencies to identify affected devices, collect forensic memory captures, mitigate compromises and report inventories and remediation steps by early October.

CISA’s emergency directive, issued Sept. 25, 2025, requires agencies to locate all Cisco ASA and Firepower devices in their environments, run CISA-provided forensic procedures and submit core memory files for analysis by the end of the agency’s specified deadline. Agencies must disconnect or isolate compromised or unsupported devices, apply vendor fixes where available and provide CISA with an inventory of affected products and actions taken by Oct. 2, 2025, the agency said. CISA also added the exploited flaws to its Known Exploited Vulnerabilities catalog.

Cisco said its investigation, opened in May after multiple government incident response engagements, found two...