On September 16, 2026, Cisco published a security advisory for its Cisco Secure Firewall products. The update closes eight vulnerabilities (CVE-2026-20329 to CVE-2026-20336) that the company found during a comprehensive internal security review. The severity is critical, up to 9.9 out of 10 on the CVSS scale.

Moreover, attackers already use two of these flaws in real attacks.

What we know about the Cisco Secure Firewall flaws

  1. Which products are at risk. Three products are vulnerable: Cisco Secure Firewall ASA, Secure Firewall Threat Defense (FTD) and Secure Firewall Management Center (FMC). According to Cisco, the flaws do not depend on the device configuration.
  2. What is already under attack. Both exploited flaws affect Management Center, the central console for managing firewalls. The first one involves static credentials, and the second one allows an authentication bypass.
  3. What the threat is. Whoever controls the management console controls the rules of all connected firewalls. As a result, an attacker can open access to the internal network, intercept traffic or turn off protection.
  4. There are no workarounds. Cisco states directly that no temporary measures exist. Only a software update helps.

Fixed versions

  • ASA: 9.16 and earlier to 9.16.4.103; 9.18 to 9.18.4.94; 9.20 to 9.20.4.49; 9.22 to 9.22.3.26; 9.23 to 9.23.1.47; 9.24 to 9.24.1.26.
  • FTD and FMC: 7.0 and earlier to 7.0.10; 7.2 to 7.2.12; 7.4 to 7.4.8; 7.6 to 7.6.6; 7.7 to 7.7.13; 10.0 to 10.0.2.

Before updating, Cisco advises checking that the device has enough memory and that the hardware supports the new version.

Why it matters for Ukrainian organizations

Cisco firewalls protect the perimeter of banks, government bodies and critical infrastructure. If attackers break the perimeter, the other security tools lose much of their value.

The most common problem is equipment that runs an old version for years: “it works, so we do not touch it”. Teams postpone updates because they fear downtime or lack a specialist. That is exactly why such devices become the first target after an advisory comes out.

Read also: Hackers attack Cisco email gateways through attachments; CISA adds five old vulnerabilities to the KEV catalog; Microsoft releases an out-of-band Exchange Server update.

S-byte is a Cisco partner: we update your Cisco Secure Firewall without downtime

S-byte has experience in state TPI expertise of Cisco equipment, including Cisco Secure Firewall CSF220. Therefore, we know how to update your perimeter safely.

  • Version check and perimeter audit. We find vulnerable devices, check whether the management console is reachable from outside and look for signs of compromise.
  • Planned ASA, FTD and FMC updates. We check hardware compatibility, back up the configuration and update within an agreed maintenance window.
  • Technical support with SLA. We follow vendor advisories and install critical updates on time.
  • Modernization of outdated equipment. If the vendor no longer supports a device, we choose and deploy a modern replacement.
  • Information security audit. We assess the security of the whole infrastructure and prepare you for regulator inspections.

If Cisco Secure Firewall runs in your network, do not delay the update. Contact S-byte, and we will check your equipment and help update it safely.