Cisco ASA
Cisco's Adaptive Security Appliance firewall line, targeted by the ArcaneDoor zero-day campaign in 2024.
Cisco ASA firewalls carried FIRESTARTER, a UAT-4356 implant that CISA and the NCSC disclosed on 24 April 2026 and that outlasts every patch; one US federal agency still hosted it six months after patching.
Last refreshed: 12 October 2026
Why do state hackers keep coming back to Cisco's ASA firewalls?
Timeline for Cisco ASA
Mentioned in: Cisco reaches 100 entries on CISA's list
Cybersecurity: Threats and DefencesMentioned in: UAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesMentioned in: FIRESTARTER implant survives every Cisco firewall patch
Cybersecurity: Threats and DefencesMentioned in: Federal agency stayed compromised six months
Cybersecurity: Threats and DefencesMentioned in: CL-STA-1132 exploited PAN-OS since 16 April, log destruction confirmed
Cybersecurity: Threats and DefencesBackground
Cisco ASA, the Adaptive Security Appliance, is Cisco's firewall and VPN gateway line, also sold as Cisco Secure Firewall ASA. CISA has listed ASA flaws as exploited since 2021, and its Known Exploited Vulnerabilities catalogue now holds at least 14 of them. The latest, CVE-2026-20349, went on the list on 11 August 2026 with a three-day deadline.
State-backed attackers return to the ASA because it sees and controls all traffic at the network EDGE. In April 2024 Cisco Talos disclosed ArcaneDoor, a campaign by the actor it tracks as UAT-4356, which chained CVE-2024-20353 and CVE-2024-20359. The attackers planted Line Dancer, an implant that lived only in memory, and Line Runner, a backdoor that survived reboots and upgrades.
Two more zero-days, CVE-2025-20333 and CVE-2025-20362, led CISA to issue Emergency Directive 25-03 on 25 September 2025. It told federal agencies to inventory their ASA and Firepower devices, hunt for compromise, patch, and disconnect ASA hardware reaching end of support by 30 September.
Patching no longer cleans an ASA
Joint advisory AA26-113A, published on 24 April 2026, described FIRESTARTER embedding itself in the boot sequence of ASA and Firepower Threat Defense appliances. FIRESTARTER survives every patch and firmware update, and only a hard power cycle removes it.
One federal agency had applied the September 2025 ASA patches on schedule and was still hosting the implant in March 2026, six months later. CISA's 23 April 2026 update to Emergency Directive 25-03 ordered agencies to unplug public-facing Firepower and Secure Firewall devices by 30 April, because a reboot did not clear FIRESTARTER.