UAT-4356 Exploits Critical Vulnerabilities in Cisco Firepower Devices FXOS

# UAT-4356 Exploits Critical Vulnerabilities in Cisco Firepower Devices FXOS

What happened

Cisco Talos Intelligence Group has identified ongoing active exploitation by the threat actor UAT-4356 against Cisco Firepower devices. Specifically, UAT-4356 is leveraging two known n-day vulnerabilities — CVE-2025-20333 and CVE-2025-20362 — within the Firepower eXtensible Operating System (FXOS). These vulnerabilities allow unauthorized attackers to bypass authentication mechanisms and gain elevated privileges on the targeted devices.

The attacks have been observed in the wild since early 2026, with increasing sophistication and targeting of enterprise-grade Cisco Firepower appliances that serve as critical network security gateways. The exploitation of these vulnerabilities enables attackers to execute arbitrary code, manipulate firewall policies, and potentially pivot deeper into corporate networks.

Confirmed facts

• Vulnerabilities exploited:
• *CVE-2025-20333*: An authentication bypass vulnerability in Cisco Firepower FXOS.
• *CVE-2025-20362*: A privilege escalation flaw allowing attackers to gain root-level access.
• Threat actor: UAT-4356, known for targeting network infrastructure devices with tailored exploits.
• Attack vector: Remote exploitation over network interfaces exposed by Firepower devices.
• Impact: Unauthorized access, potential data interception, firewall rule manipulation, and lateral movement within affected networks.
• Detection: Cisco Talos has released detection signatures and indicators of compromise (IOCs) related to UAT-4356 activity.
• Mitigation: Cisco has issued security advisories with patches and workarounds addressing these vulnerabilities.

Who is affected

Organizations using Cisco Firepower devices running vulnerable versions of FXOS are at high risk. This includes enterprises, managed security service providers, and government agencies relying on these devices for perimeter defense and intrusion prevention.

Particularly vulnerable are devices that have not applied the latest security updates or have exposed management interfaces to untrusted networks. The attack targets both on-premises deployments and cloud-managed Firepower instances where FXOS is in use.

What to do now

1. Identify affected devices: Inventory all Cisco Firepower appliances and verify their FXOS versions.
2. Apply patches immediately: Deploy Cisco's official security patches for CVE-2025-20333 and CVE-2025-20362 without delay.
3. Restrict network exposure: Limit access to management interfaces to trusted IP addresses only and disable any unnecessary services.
4. Monitor logs and alerts: Utilize Cisco Talos detection signatures to scan for indicators of compromise and anomalous activity.
5. Conduct incident response: If compromise is suspected, isolate affected devices, perform forensic analysis, and reset credentials.
6. Update firewall rules: Review and tighten firewall policies to prevent lateral movement.

How to secure yourself

• Regularly update device firmware and software: Keeping FXOS and related components up to date is critical.
• Implement strong access controls: Use multi-factor authentication (MFA) for device management and restrict administrative access.
• Network segmentation: Separate management interfaces from general network traffic and enforce strict segmentation.
• Continuous monitoring: Deploy intrusion detection systems (IDS) and endpoint detection and response (EDR) tools that can flag unusual behavior.
• User training and awareness: Educate network administrators on emerging threats and best practices for device security.

FAQ

What is UAT-4356?

UAT-4356 is a sophisticated cyber threat actor known for targeting network infrastructure devices, particularly Cisco Firepower appliances, using zero-day and n-day vulnerabilities.

Are all Cisco Firepower devices affected?

Only devices running vulnerable versions of the Firepower eXtensible Operating System (FXOS) that have not applied patches for CVE-2025-20333 and CVE-2025-20362 are at risk.

How can I check if my device is vulnerable?

Verify your device’s FXOS version against Cisco’s security advisory and use network scanning tools to detect exposure of management interfaces.

What are the risks of exploitation?

Attackers can gain unauthorized access, manipulate firewall rules, intercept network traffic, and move laterally within your network.

Has Cisco provided patches?

Yes, Cisco has released firmware updates and security patches addressing these vulnerabilities.

Can this attack lead to data breaches?

Yes, unauthorized control over Firepower devices can facilitate data interception and compromise of sensitive information.

What immediate steps should I take if I suspect compromise?

Isolate affected devices, reset administrative credentials, apply patches, and conduct a thorough security audit.

Does enabling MFA help?

While MFA strengthens access controls, it does not mitigate the vulnerabilities directly but is recommended as part of a layered defense.

Is there ongoing monitoring available?

Cisco Talos provides updated detection signatures and threat intelligence feeds to monitor UAT-4356 activity.

What changed in 2026 regarding this threat?

Cisco released comprehensive patches and enhanced detection tools, while UAT-4356 has diversified its targeting beyond Firepower devices.

Why this matters

Cisco Firepower devices are cornerstone components of enterprise network security, responsible for firewalling, intrusion prevention, and traffic inspection. Exploitation of FXOS vulnerabilities by UAT-4356 undermines these defenses, exposing organizations to significant risk of network compromise and data theft.

Given the widespread deployment of Cisco Firepower in critical infrastructure and corporate environments, failure to address these vulnerabilities promptly can lead to severe operational disruptions and regulatory consequences.

Sources and corroboration talosintelligence.com](https://blog.talosintelligence.com/uat-4356-firestarter/), along with corroborating security community reports and Cisco’s official security bulletins.

---

Stay informed with HackWatch for the latest cybersecurity threat intelligence and actionable defense strategies.