---
title: CISA Issues Emergency Directive After Nearly Year-Long Cisco Zero-Day Attack Campaign
description: CISA issues emergency directive as Chinese-linked attackers exploit Cisco firewall vulnerabilities, urging federal agencies to act swiftly.
canonical_url: https://codekeeper.co/ticker/cisa-emergency-directive-cisco-firewall-exploit
---

# CISA Issues Emergency Directive After Nearly Year-Long Cisco Zero-Day Attack Campaign

CISA issues emergency directive as Chinese-linked attackers exploit Cisco firewall vulnerabilities, urging federal agencies to act swiftly.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 26, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

The Cybersecurity and Infrastructure Security Agency issued an emergency directive Thursday after discovering attackers have been exploiting Cisco firewall vulnerabilities since at least November 2024. The attacks began with reconnaissance activity and escalated to memory modification on hundreds of federal government firewalls. Cisco launched its investigation in May but waited four months to disclose the vulnerabilities and release patches. CISA's Chris Butera said the delay was necessary for proper investigation and patch development. Federal agencies must take immediate action by Friday's deadline. While officials won't confirm attribution, outside researchers link the espionage campaign to Chinese state-sponsored groups. CISA warns attackers may accelerate or shift tactics now that the vulnerabilities are public. **Source:** [CyberScoop](https://cyberscoop.com/cisa-emergency-directive-timeline-investigation/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-emergency-directive-cisco-firewall-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Phishing Attack Bypasses Microsoft 365 MFA to Hijack a Finance Mailbox and Steal Payments Aug 24, 2026](https://codekeeper.co/ticker/phishing-attack-microsoft-365-bypass-mfa)

[Vulnerabilities Critical GitLab Vulnerability Under Active Attack — Patch Now Aug 24, 2026](https://codekeeper.co/ticker/gitlab-vulnerability-cve-2026-19478-patch-now)

[Cyberattacks $86 Million Crypto Heist Tied to Tampered Ledger Hardware Oct 14, 2026](https://codekeeper.co/ticker/ledger-device-hack-86m-crypto-stolen)

[ShinyHunters Exploited Oracle Zero-Day to Hit Over 100 Organizations, Mostly Universities Aug 12, 2026](https://codekeeper.co/ticker/shinyhunters-oracle-peoplesoft-zero-day-breach)