The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) actively exploited zero-day vulnerabilities in Cisco Secure Firewall ASA and Firepower Threat Defense (FTD) to its Known Exploited Vulnerabilities (KEV) catalog, linking them to the ArcaneDoor campaign. First identified in 2024, the ArcaneDoor campaign is a sophisticated cyber-espionage operation, where an advanced threat actor exploited zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) to gain persistent, unauthenticated access to government and critical infrastructure networks. The attackers demonstrated the rare ability to modify read-only memory (ROM), ensuring persistence across reboots and upgrades, making ArcaneDoor one of the most advanced campaigns targeting Cisco firewalls to date. The vulnerabilities include CVE-2025-20362, a missing authorization flaw, and CVE-2025-20333, a buffer overflow vulnerability allowing for remote code execution (RCE). The flaws can be chained together for powerful attacks enabling persistent compromise. CISA’s emergency directive requires all Federal Civilian Executive Branch (FCEB) agencies to identify, analyze, and remediate affected devices by no later than September 26, 2025, with full reporting and inventory actions due by October 2. Agencies must patch supported devices, retire unsupported ones, and isolate compromised systems. While directed at federal entities, experts warn that private organizations should also review and mitigate these critical vulnerabilities to safeguard against widespread exploitation. CTIX analysts urge any potentially affected administrators to follow the guidance linked in the advisory below.