The Lock on the List
Cisco sells security. So we checked the government's list.
The catalogue.
The US cyber defence agency, CISA, keeps a catalogue. Every flaw on it is one that attackers are known to have used. Not maybe. Used.
Its name is the Known Exploited Vulnerabilities Catalog. On 23 October 2026, its feed carried 1,756 entries, each with a CVE number, the vendor and product, the date it was added, a due date for federal agencies, and a required action: "Apply mitigations in accordance with vendor instructions … or discontinue use of the product if mitigations are unavailable."
One hundred and one.
As of the twenty-third of October, Cisco has one hundred and one entries on it.
Fifty were added in 2022, the year the catalogue was filling in its back list. Then seven. Then six. Then eight.
And this year, nineteen. The most since 2022. With two months still to go. Nineteen Cisco entries by the twenty-third of October: more than the catalogue added for Cisco in the whole of 2023, 2024 or 2025.
The count is by the year each entry was added to the catalogue, not the year a flaw was found: the catalogue was created in November 2021 and back-filled older exploited flaws, which is why 2021 and 2022 carry 61 of the 101. The newest three Cisco entries: CVE-2026-76460 in Identity Services Engine, added 16 September 2026; CVE-2026-76504 in Catalyst SD-WAN Manager, 30 September; CVE-2026-76519 in Secure Email Gateway, 14 October. Each carries a due date three days after it was added. The catalogue's own product groupings for Cisco are uneven ("IOS and IOS XE Software" 14 entries, "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)" 6, "IOS XR" 6, "Catalyst SD-WAN Manager" 5), so this piece counts entries, not products, and ranks Cisco against no other vendor: the catalogue carries no count of anyone's products or installed base.
The emergency directives.
Then there are CISA's emergency directives. Orders to every federal agency, drop everything.
Since January 2024, CISA lists five of them. Two are about Cisco.
An emergency directive, in CISA's own words, "applies to all federal information systems managed on agency networks" and "does not apply to contractors". The five on CISA's listing: ED 24-01 on Ivanti Connect Secure and Policy Secure (19 January 2024); ED 25-02 on Microsoft Exchange (7 August 2025); ED 25-03 on Cisco ASA firewalls (25 September 2025); ED 26-01 on F5 devices (15 October 2025); ED 26-03 on Cisco SD-WAN (25 February 2026). On 8 January 2026 CISA retired ten older directives of 2019 to 2024 at once, so the listing is of the directives in force, not of every directive ever issued.
In its own words.
In September last year, the first: hunt for compromise on Cisco firewalls.
In its own words: an advanced threat actor, manipulating read-only memory to persist through reboot and system upgrade.
The directive of 25 September 2025 opens: "CISA is aware of an ongoing exploitation campaign by an advanced threat actor targeting Cisco Adaptive Security Appliances", and names the persistence: "manipulating read-only memory (ROM) to persist through reboot and system upgrade." It adds: "Cisco assesses that this campaign is connected to the ArcaneDoor activity identified in early 2024".
The clock.
Agencies had one day to hand over memory dumps. One week for a full inventory.
In February this year, the second: Cisco's SD-WAN. Patch within two days.
And in April, the firewall order was widened. This time CISA said a reboot was not enough. Power it down. Hard.
The dates, from the directives themselves. ED 25-03, issued 25 September 2025: core dumps to CISA "by 11:59PM EST on September 26, 2025"; a complete inventory "By 11:59 PM EST on October 2, 2025". ED 26-03, issued 25 February 2026: identify every in-scope SD-WAN system, store logs externally and report by 26 February; Cisco's updates applied by 5:00 PM ET on 27 February; a detailed inventory by 5 March, a hardening report by 12 March, logs to CISA by 23 March; and if a root account is compromised, "Rebuild control management plane". ED 25-03's V1 of 23 April 2026 widened the first order to the Firepower and Secure Firewall series: core dumps and the patches, including the one for the persistence issue, by 24 April; "a reboot is not sufficient to expunge the malware", so a hard reset by unplugging the power supply by 30 April; an inventory by 1 May.
ArcaneDoor.
Cisco's own researchers had named the campaign a year and a half earlier. ArcaneDoor. A state-sponsored actor, in Cisco's words. Going after the perimeter. Government networks, globally.
Cisco Talos, 24 April 2024: "ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices"; the actor "now tracked as UAT4356 by Talos"; "we assess with high confidence that these actions were performed by a state-sponsored actor." The two backdoors were named "Line Runner" and "Line Dancer"; the actor's infrastructure dated "back to early November 2023"; the further victims "all of which involved government networks globally." Talos names no country, and neither does this piece.
Eight point two billion.
Meanwhile, Cisco's security business brought in eight point two billion dollars last year. Up two percent.
Out of sixty-three billion.
Cisco's 10-K for fiscal 2026 gives revenue by product category: Networking $34,668 million, Services $15,030 million, Security $8,232 million, Collaboration $4,300 million, Observability $1,095 million; $63,325 million in all. On Security: "Revenue in our Security product category increased by 2%, or $0.1 billion, primarily driven by growth in our SASE and Network Security offerings."
To be fair.
To be fair, Cisco gear runs a huge share of the world's networks. More boxes, more targets. The list counts flaws used against Cisco, not how Cisco compares to anyone else. And Cisco patched these.
Cisco's fixes for CVE-2025-20333 and CVE-2025-20362 were published on 25 September 2025 at 16:00 GMT, the day of the directive, as fixed releases with no workarounds. The persistence issue of April 2026 got its own advisory on 23 April 2026, the day CISA widened the order: "the ArcaneDoor threat actor has developed a previously unknown persistence mechanism" in the Firepower operating system, affecting the Firepower 1000, 2100, 4100 and 9300 and the Secure Firewall 1200, 3100 and 4200 series.
But a security company on the government's list of flaws in active use. One hundred and one times.
And nineteen this year.
Every figure from CISA's catalogue, its directives, and Cisco's own filing.
Sources
- CISA, Known Exploited Vulnerabilities Catalog, the JSON feed: catalogVersion 2026.10.23, released 23 October 2026, 1,756 entries; 101 with the vendor Cisco, by the year added 11 (2021), 50 (2022), 7 (2023), 6 (2024), 8 (2025), 19 (2026, to 23 October). Counted by Token Runner from the feed on 24 October 2026. The catalogue was created in November 2021 under BOD 22-01 and back-filled older exploited flaws, so the 2021 and 2022 counts include that back-fill.
- CISA, Emergency Directive 25-03, "Identify and Mitigate Potential Compromise of Cisco Devices", 25 September 2025, and its V1 of 23 April 2026: "CISA is aware of an ongoing exploitation campaign by an advanced threat actor targeting Cisco Adaptive Security Appliances"; "manipulating read-only memory (ROM) to persist through reboot and system upgrade."; core dumps "by 11:59PM EST on September 26, 2025"; a complete inventory "By 11:59 PM EST on October 2, 2025"; "Cisco assesses that this campaign is connected to the ArcaneDoor activity identified in early 2024"; V1: core dumps and patches by 24 April 2026, "a reboot is not sufficient to expunge the malware", a hard power reset by 30 April, an inventory by 1 May 2026.
- CISA, Emergency Directive 26-03, "Mitigate Vulnerabilities in Cisco SD-WAN Systems", 25 February 2026 (V1 of 11 March 2026): "CISA is aware of a cyber threat actor's ongoing exploitation of Cisco SD-WAN systems."; CVE-2026-20127 and CVE-2022-20775; identify every in-scope system by 11:59 PM ET on 26 February 2026; Cisco's updates applied by 5:00 PM ET on 27 February 2026; a detailed inventory by 5 March, a hardening report by 12 March, logs to CISA by 23 March 2026; on a root compromise, "Rebuild control management plane"; "This Directive applies to all federal information systems managed on agency networks"; "This Directive does not apply to contractors".
- CISA, Directives, the listing filtered to Emergency Directives, read 24 October 2026: ED 24-01 Ivanti (19 January 2024), ED 25-02 Microsoft Exchange (7 August 2025), ED 25-03 Cisco (25 September 2025), ED 26-01 F5 (15 October 2025), ED 26-03 Cisco SD-WAN (25 February 2026); and CISA's news release of 8 January 2026, "CISA Retires Ten Emergency Directives, Marking an Era in Federal Cybersecurity": ten directives of 2019 to 2024 retired at once.
- Cisco Talos, "ArcaneDoor: New espionage-focused campaign found targeting perimeter network devices", 24 April 2024: "ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices"; "we identified a previously unknown actor now tracked as UAT4356 by Talos."; "we assess with high confidence that these actions were performed by a state-sponsored actor."; the two backdoors "Line Runner" and "Line Dancer"; "we identified actor-controlled infrastructure dating back to early November 2023"; "The investigation that followed identified additional victims, all of which involved government networks globally."; CVE-2024-20353 and CVE-2024-20359.
- Cisco Security Advisories: cisco-sa-asaftd-webvpn-z5xP8EUB (CVE-2025-20333, Critical, CVSS 9.9) and cisco-sa-asaftd-webvpn-YROOTUW (CVE-2025-20362), first published 25 September 2025 at 16:00 GMT, fixed releases only, no workarounds; cisco-sa-asaftd-persist-CISAED25-03, "Continued Evolution of Persistence Mechanism Against Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense", first published 23 April 2026: "the ArcaneDoor threat actor has developed a previously unknown persistence mechanism" residing in "the Cisco Firepower eXtensible Operating System (FXOS)".
- Cisco Systems, Form 10-K for the fiscal year ended 25 July 2026, filed 2 September 2026, Management's Discussion and Analysis: revenue by product category, Networking $34,668 million, Security $8,232 million, Collaboration $4,300 million, Observability $1,095 million, Services $15,030 million, total $63,325 million; "Revenue in our Security product category increased by 2%, or $0.1 billion, primarily driven by growth in our SASE and Network Security offerings."; "Total revenue was $63.3 billion, an increase of 12% compared with fiscal 2025."