Search: “Secure Firewall Threat Defense”

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

Cisco's September 2026 firewall hardening release fixes internally found ASA, FTD, and FMC flaws, two of which are actively exploited.

Cisco released September 2026 hardening updates for Secure Firewall ASA, FTD, and FMC software addressing multiple vulnerabilities discovered during a comprehensive internal security review. Two of the vulnerabilities are known to be actively exploited, including a Cisco Secure Firewall Management Center static credential vulnerability. Details are provided in separate linked advisories.

Cisco Security Advisories·Sep 16, 16:00 UTC · 21h agoAdvisory in the wild 6 sources

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

Cisco patched an unauthenticated remote DoS in ASA and FTD Remote Access SSL VPN that reloads devices via crafted HTTP requests.

Cisco disclosed a denial-of-service vulnerability in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. Insufficient error checking when processing HTTP requests allows an unauthenticated, remote attacker to send a crafted HTTP request that causes the affected device to reload. Cisco has released software updates addressing the flaw.

Cisco Security Advisories·Aug 11, 16:39 UTC · Aug 11, 2026Advisory

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities

Cisco patched ACL Object Group Search bypass flaws in ASA and FTD firewall software that let unauthenticated attackers reach protected networks.

Cisco disclosed multiple vulnerabilities in the ACL Object Group Search implementation of Secure Firewall ASA and FTD Software, caused by a logic error in populating group access control policies. An unauthenticated remote attacker could send traffic that should be blocked through the device, bypassing configured access controls. Cisco has released software updates; no exploitation is mentioned.

Cisco Security Advisories·Sep 16, 16:00 UTC · 21h agoAdvisory 9 sources

Threat Advisory: Opportunistic cyber criminals take advantage of Ukraine invasion

Cisco Talos·Mar 14, 12:00 UTC · Mar 14, 2022AdvisoryCVE-2017-11882

Threat Advisory: 3CX Softphone Supply Chain Compromise

Cisco Talos·Mar 30, 22:29 UTC · Mar 30, 2023Advisory

Threat Advisory: Spring4Shell

Cisco Talos·Mar 31, 22:14 UTC · Mar 31, 2022AdvisoryCVE-2022-22965CVE-2022-22963CVE-2010-1622

Threat Advisory: Critical F5 BIG

Cisco Talos·May 10, 19:32 UTC · May 10, 2022Advisory in the wildCVE-2022-1388

Threat Advisory: DoubleZero

Cisco Talos·Mar 24, 16:57 UTC · Mar 24, 2022Advisory

Cisco Talos Advisory on Adversaries Targeting the Healthcare and Public Health Sector

Cisco Talos·Oct 30, 21:30 UTC · Oct 30, 2020Advisory

Cymatic names Stuart McClure to its advisory board

Help Net Security·Oct 29, 00:00 UTC · Oct 29, 2020Advisory

Federal agencies not fully patching vulnerable Cisco devices amid ‘active exploitation,’ CISA warns

The Record·Apr 27, 00:00 UTC · Apr 27, 2026Advisory in the wildCVE-2025-20333CVE-2025-20362

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

Huntress·Sep 10, 15:00 UTC · 6d agoAdvisory

CISA Warns of Active Exploitation Following FortiBleed Leak

Security Affairs·Jun 20, 08:27 UTC · Jun 20, 2026Advisory in the wild

Threat Advisory: HAFNIUM and Microsoft Exchange zero

Cisco Talos·Mar 4, 15:58 UTC · Mar 4, 2021Advisory in the wildCVE-2021-26855CVE-2021-26857CVE-2021-26858+5 CVEs1

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO Online·Sep 8, 17:16 UTC · 8d agoAdvisory in the wild

Kaspersky Security Bulletin: Threat Predictions for 2018

Kaspersky Securelist·Nov 15, 10:01 UTC · Nov 15, 2017Advisory