Cisco Talos
Cisco's threat intelligence and research TEAM.
Cisco's own firewalls and network managers are the targets Talos keeps reporting on. On 30 September 2026 Cisco logged its 100th entry on the US exploited-flaw list, five months after Talos judged the FIRESTARTER implant a step beyond ArcaneDoor.
Last refreshed: 12 October 2026
What did Cisco Talos find inside Cisco's own firewalls?
Timeline for Cisco Talos
Named as Cisco Talos
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listMentioned in: UAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesMentioned in: FIRESTARTER implant survives every Cisco firewall patch
Cybersecurity: Threats and DefencesBackground
Cisco Talos is the threat intelligence and research group inside Cisco, staffed by researchers, analysts and engineers WHO follow attack campaigns and publish their findings on the Talos blog. When the target is Cisco equipment, Talos is describing attacks on its parent company's own products.
Talos disclosed ArcaneDoor on 24 April 2024: a state-sponsored espionage campaign by an actor it calls UAT4356, which used two flaws in Cisco ASA and Firepower devices, CVE-2024-20353 and CVE-2024-20359, to install implants Talos named Line Dancer and Line Runner. Talos never established how the attackers won their first foothold.
In April 2026 Talos and the UK's National Cyber Security Centre assessed FIRESTARTER as an escalation on ArcaneDoor. The 2024 implants lived in memory, so a reboot wiped them; FIRESTARTER hooks the boot sequence and comes back after a restart.
Talos tracks attackers inside Cisco's defences
On 24 April 2026 the US Cybersecurity and Infrastructure Security Agency and Britain's NCSC named FIRESTARTER, a backdoor in Cisco firewall startup code that outlives every patch. For Talos it was the sequel to ArcaneDoor, its own 2024 find, with one difference that mattered: an unnamed US agency applied every fix on time and was still infected six months later, and only a full power-down clears FIRESTARTER.
The products Talos defends stayed under fire. On 14 May a maximum-severity Cisco SD-WAN flaw joined the urgent patch list while a China-linked group was already using it, Cisco's sixth exploited networking flaw of 2026. On 30 September Cisco reached 100 entries on that list, the second vendor to get there after Microsoft.