Home/Cisco/Firepower NGFW series/Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle

Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle

SKU FPR4140-FTD-HA-BUN

Cisco Chassis · Firepower NGFW series

Official Cisco notice (EOL13333) ↗ Retrieved 2026-10-25

Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle is dead. Cisco support ended 2025-08-31 (-421d). Last available for order 2020-08-31.

Is the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle still supported?

No. Cisco ended support for the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle on 2025-08-31. No further security fixes will be issued. See Cisco's lifecycle bulletin.

When does the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle reach end of support?

Cisco support for the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle ends on 2025-08-31.

What replaces the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle?

Cisco has not published a successor model for the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle.

What known-exploited CVEs apply to the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle past end of support?

14 CVEs in CISA's Known Exploited Vulnerabilities catalog apply to the platform the Cisco Firepower 4140 Threat Defense Chss,Subs HA Bundle runs. These will not be patched on this device because it is past the Cisco security-support date. See the Known Exploited Vulnerabilities table below for the full list.

Known Exploited Vulnerabilities

This device is past Cisco's security-support date. 14 CVEs in CISA's Known Exploited Vulnerabilities catalog apply to the platform it runs. Cisco is not issuing patches for this model. Isolate, compensate, or refresh.

CVE	KEV added	Vulnerability	Flags
`CVE-2026-20349`	2026-08-11	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability Advisory 1 Advisory 2 Advisory 3
`CVE-2025-20362`	2025-09-25	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability Advisory 1 Advisory 2 Advisory 3
`CVE-2025-20333`	2025-09-25	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability Advisory 1 Advisory 2 Advisory 3
`CVE-2014-2120`	2024-11-12	Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability Advisory 1 Advisory 2
`CVE-2024-20481`	2024-10-24	Cisco ASA and FTD Denial-of-Service Vulnerability Advisory 1 Advisory 2
`CVE-2024-20359`	2024-04-24	Cisco ASA and FTD Privilege Escalation Vulnerability Advisory 1 Advisory 2
`CVE-2024-20353`	2024-04-24	Cisco ASA and FTD Denial of Service Vulnerability Advisory 1 Advisory 2
`CVE-2020-3259`	2024-02-15	Cisco ASA and FTD Information Disclosure Vulnerability Advisory 1 Advisory 2	Ransomware
`CVE-2023-20269`	2023-09-13	Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability Advisory 1 Advisory 2	Ransomware
`CVE-2016-6366`	2022-05-24	Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability Advisory 1
`CVE-2016-6367`	2022-05-24	Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability Advisory 1
`CVE-2020-3452`	2021-11-03	Cisco ASA and FTD Read-Only Path Traversal Vulnerability Advisory 1
`CVE-2020-3580`	2021-11-03	Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability Advisory 1	Ransomware
`CVE-2018-0296`	2021-11-03	Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability Advisory 1

Source: CISA Known Exploited Vulnerabilities catalog. The Ransomware flag reflects CISA's own knownRansomwareCampaignUse field, set when the CVE has been observed in ransomware campaigns per their threat intel. It's not a property of the vulnerability description itself.

Correlation is at the platform level, not per-OS-version. Not exhaustive: KEV only lists actively-exploited CVEs and many relevant unexploited vulnerabilities are not here. Verify against vendor security advisories (PSIRT, JSA, PAN-SA) and NVD before acting. See compensating controls if refresh isn't immediate.

Announced 2020-03-02

End of Sale 2020-08-31

End of Support 2025-08-31