Cisco ASA 5500-X Series Firewalls — End-of-Life & EOSL Dates
Adaptive Security Appliance firewalls. Support dates split by model. The 5512-X/5515-X lack Secure Boot and were targeted in the ArcaneDoor attack campaign against out-of-support units.
Is the Cisco ASA 5500-X Series Firewalls end of life?
Mixed — varies by part numberCisco ASA 5500-X Series Firewalls has mixed lifecycle status — some SKU groups are already past Cisco end of service while others run until Aug 2026. Confirm the exact part number before any support or refresh decision. For past-EOSL units, weigh third-party maintenance, spares, replacement, or a documented run-to-failure. Cisco’s named migration path: Cisco Firepower 2100 Series / Cisco Firepower 1000 Series.
Why this score
- Past end of service life — 48 months ago
- Vendor-published date, source-linked
- Mixed status across SKU groups — some past EOSL, some still supported
- Vendor-named replacement / migration path available
- Category: firewall / security appliance
The score reflects support-lifecycle timing and source confidence only — higher means more support runway. It is not a risk, safety or compliance rating. How it’s calculated →
Documented real-world exploitation of out-of-support units
Public security reporting documents active exploitation affecting this product line — summarized here because units past their last date of support no longer receive vendor fixes. This describes the published campaigns, not the state of any specific device.
ArcaneDoor espionage campaign (2024) · CVE-2024-20353 · CVE-2024-20359
Cisco Talos documented a state-sponsored campaign (UAT4356) implanting the Line Runner and Line Dancer backdoors on Cisco ASA devices, exploiting these two vulnerabilities. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog. ASA units past their last date of support no longer receive the fixed software.
Sources: Cisco Talos — ArcaneDoor report ↗ · CISA alert (2024-04-24) ↗
CISA Emergency Directive ED 25-03 (2025) · CVE-2025-20333 · CVE-2025-20362
In September 2025 CISA ordered US federal agencies to identify and mitigate potentially compromised Cisco ASA and Firepower devices after active exploitation of these chained vulnerabilities, which allow a remote unauthenticated attacker to take full control of unpatched devices. End-of-support ASA hardware cannot receive the fixed releases and the directive's guidance is to permanently disconnect such devices.
Sources: CISA ED 25-03 ↗ · CISA alert (2025-09-25) ↗
5512-X / 5515-X (no Secure Boot)
EOSL — PAST15 SKUs in this group
5525-X / 5545-X / 5555-X
EOSL — PAST25 SKUs in this group
5508-X / 5516-X
ENDING SOON12 SKUs in this group
5506-X / 5506H-X
ENDING SOON8 SKUs in this group
Options from here
Mixed — varies by part number40 Cisco ASA 5500-X Series Firewalls part numbers are past Cisco end of service while 20 remain supported (to Aug 2026). For the past-EOSL units, these are the usual paths:
Keep it in production past the OEM cutoff with an independent maintainer.
Buy spares now, while units still circulate on the secondary market.
It is unsupported today — set a migration timeline and budget.
Low-criticality role — document the risk, harden backups, retire on your terms.
Independent and informational — EOSL.ai sells no hardware or maintenance and lists no paid placements. Third-party maintenance keeps unsupported gear in production past the OEM cutoff; whether it fits depends on the asset's role.
ASA 5500-X Series Firewalls — questions
Is the Cisco ASA 5500-X Series Firewalls end of life?
Partly — some 5500-X Series Firewalls SKU groups are past end of service life while others are still supported. See the dates by SKU group below.
What is the last date of support for the 5500-X Series Firewalls?
Last dates of support across 5500-X Series Firewalls SKU groups range from Aug 2022 to Aug 2026.
Where do these 5500-X Series Firewalls dates come from?
Every end-of-sale and end-of-service-life date on this page links to the official Cisco EOL bulletin it was taken from.
What is the replacement for the 5500-X Series Firewalls?
Cisco's end-of-life bulletins list Cisco Firepower 2100 Series and Cisco Firepower 1000 Series as the recommended migration path for the 5500-X Series Firewalls. Exact per-part-number replacements are in the linked bulletins.
On the same timetable
Embed this status on your wiki or README
