Cisco firewalls under ArcaneDoor attack: patch ASA and FTD, and replace 5500-X models past end of support

Cisco’s event response page, last updated April 24, 2026, says the ArcaneDoor actor exploited ASA 5500-X firewalls with VPN web services enabled, gained persistence on models without Secure Boot, and has broadened to any device running ASA or FTD software. The 5506-X, 5508-X and 5516-X reached their last date of support on August 31, 2026.

Source facts

Cisco’s event response on continued attacks against Cisco firewalls, first published September 25, 2025 and last updated April 24, 2026, says attacks targeted ASA 5500-X devices running ASA software with VPN web services enabled to implant malware, execute commands and potentially exfiltrate data, and that attackers disabled logging, intercepted CLI commands and crashed devices to prevent analysis. Cisco says the evidence strongly indicates CVE-2025-20333 and CVE-2025-20362 were used.

On older 5500-X models without Secure Boot and Trust Anchor support, Cisco observed ROMMON modified for persistence across reboots and upgrades; the compromised models it lists, 5512-X, 5515-X, 5525-X, 5545-X, 5555-X and 5585-X, had last dates of support between August 2022 and September 2025. An April 23, 2026 CISA update to Emergency Directive 25-03 says the actor developed a persistence mechanism in the FXOS base operating system that survives upgrades to the September 2025 fixed releases, and broadened its targeting to any device running ASA or FTD software.

The 5506-X, 5506H-X, 5506W-X, 5508-X and 5516-X support Secure Boot and had no observed exploitation, but Cisco lists their last date of support as August 31, 2026. Cisco strongly recommends upgrading to fixed releases and migrating devices that cannot be upgraded because of end of life to supported hardware, and for suspected compromise, treating all configuration as untrusted and rebuilding from factory defaults with new passwords, certificates and keys.

Applicability

Use this for any Cisco ASA or FTD deployment. Fixed releases differ by software train and CISA’s directive is addressed to federal agencies; check Cisco’s page and advisories for current fixed releases and detection guidance.

DSE recommendation

DSE recommends upgrading every Cisco ASA and FTD device to a fixed release now, and replacing any ASA 5500-X appliance that is past its last date of support. Until replacement, disable SSL VPN web services that are not needed, restrict management access, follow Cisco’s detection guide, and build replacement configurations from a reviewed design rather than copying an old configuration that may be untrusted.

Verification

Record each firewall’s model, software release and VPN settings, confirm the release matches Cisco’s fixed-release tables, and after upgrading older models check for the firmware_update.log file Cisco describes as a sign that persistence was removed.

Official reference

Cisco — Cisco Event Response: Continued Attacks Against Cisco Firewalls (last updated April 24, 2026). Reviewed October 18, 2026.