---
title: State-Sponsored Hackers Exploit Multiple Cisco Zero-Days in Widespread Campaign
description: CISA alerts on critical zero-day exploits in Cisco devices by state hackers, urging urgent updates to prevent ArcaneDoor attacks.
canonical_url: https://codekeeper.co/ticker/cisa-warns-zero-day-exploits-cisco-devices
---

# State-Sponsored Hackers Exploit Multiple Cisco Zero-Days in Widespread Campaign

CISA alerts on critical zero-day exploits in Cisco devices by state hackers, urging urgent updates to prevent ArcaneDoor attacks.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 26, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA issued an emergency directive after discovering state-sponsored hackers are actively exploiting multiple zero-day vulnerabilities in Cisco firewalls and networking equipment. The campaign targets millions of devices, including ASA 5500-X series firewalls and IOS systems. Three critical flaws allow remote code execution and privilege escalation: CVE-2025-20333 (CVSS 9.9), CVE-2025-20363 (CVSS 9.0), and CVE-2025-20362 (CVSS 6.5). A separate zero-day, CVE-2025-20352, affects SNMP systems in Cisco IOS software. The attacks appear connected to the ArcaneDoor espionage campaign from spring 2024. Federal agencies must disconnect unsupported devices and upgrade others by September 26. Many affected devices are end-of-life, making immediate patching or replacement critical for organizations worldwide. **Source:** [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/cisco-actively-exploited-zero-day-bugs-firewalls-ios)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-zero-day-exploits-cisco-devices%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[APT Group 'Armored Likho' Hits Power Grids with New AI-Assisted Malware Aug 12, 2026](https://codekeeper.co/ticker/armored-likho-targets-critical-infrastructure)

[Cyberattacks Critical Fortinet FortiMail Zero-Day Under Active Attack Oct 2, 2026](https://codekeeper.co/ticker/fortimail-zero-day-vulnerability-cve-2026-104286)

[Ruby on Rails Patches Critical RCE Vulnerability Aug 11, 2026](https://codekeeper.co/ticker/ruby-on-rails-critical-vulnerability-patch)

[Cyberattacks Red Heron Hackers Exploit Critical Gitea Flaw to Hijack Servers Sep 16, 2026](https://codekeeper.co/ticker/red-heron-exploits-gitea-flaw-cve-2026-60004)