Category roundup
Firewall coverage should emphasize exploit activity, remote attack surface, and fixed-version clarity. Based on the current official-source dataset, Fortinet is still the strongest operational source, Zyxel still adds clean firewall patch targets, and Cisco Secure Firewall now earns a bigger place here because the August 2026 SSL VPN advisory combines active exploitation, remote reachability, and explicit fixed software.
This roundup only references official vendor material. It is meant to shorten the path from “I heard about a firewall issue” to “what fixed version does the vendor actually say to run?”
Cisco says an unauthenticated remote attacker can send crafted HTTP requests to the Remote Access SSL VPN service and force an affected Secure Firewall ASA or FTD device to reload unexpectedly, and Cisco later disclosed active exploitation in August 2026.
Fortinet says an unauthenticated attacker may be able to bypass LDAP authentication for Agentless VPN or FSSO policies under a specific LDAP-server configuration, making this a cleaner current firewall-operations story than generic release churn.
Cisco says affected Secure Firewall ASA and FTD hardware can retain a persistent implant even after the September 2025 fixes, so operators should check for compromise, reimage if needed, and move to the listed fixed releases and hotfixes.
Zyxel says a path traversal issue in the configuration-file execution CLI command of certain ZLD firewalls could let an authenticated administrator execute a crafted malicious configuration file.
Zyxel published a clean firewall advisory for privilege escalation issues affecting USG FLEX H devices and explicitly called out the patched train.
Fortinet says this FortiOS and FortiProxy issue may allow remote unauthenticated code execution via crafted HTTP requests and notes potential exploitation in the wild.
Fortinet says crafted requests may allow a remote attacker to gain super-admin privileges and explicitly notes that the issue is being exploited in the wild.