Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Cisco ASA and FTD VPN Flaw Under Active Attack Can Knock Firewalls Offline

Cisco has fixed CVE-2026-76418, a high-severity bug in the SSL remote-access VPN of ASA and FTD firewalls that lets an unauthenticated attacker force a device reload. Exploitation is already underway, so patch and check your tunnel-group settings now.

4T4Tify Team4Tify
Oct 29, 2026·5 min read
Cisco ASA and FTD VPN Flaw Under Active Attack Can Knock Firewalls Offline

Cisco ASA and FTD VPN Flaw Under Active Attack Can Knock Firewalls Offline

Cisco has shipped fixes for a high-severity vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, and it confirms the bug is already being exploited. Tracked as CVE-2026-76418 and scored 8.6 on CVSS, the flaw lets an unauthenticated remote attacker send a crafted request to the SSL remote-access VPN and force the firewall to reload. No VPN credentials are required.

What happened

The weakness lives in the Remote Access SSL VPN service and comes from logic errors that surface when secondary authentication is configured on a tunnel group. An attacker who can reach the VPN login portal can hit the faulty code path during the connection attempt and crash the appliance, producing a denial-of-service condition. Because the whole device reloads, every VPN session and all traffic passing through the firewall drops with it.

Cisco says it learned of in-the-wild exploitation in October 2026 and published its advisory on 28 October. It has not said when the attacks began, who is behind them or how many organisations have been affected. There are no workarounds; upgrading is the only permanent fix.

A device is exposed when all three of the following are true:

  • it runs a vulnerable ASA or FTD release;
  • the SSL remote-access VPN login service is reachable by the attacker;
  • secondary authentication is configured at tunnel-group scope.

Fixed ASA releases

  • 9.16 and earlier: 9.16.4.104
  • 9.18: 9.18.4.96
  • 9.20: 9.20.4.50
  • 9.22: 9.22.3.200
  • 9.23: 9.23.1.48
  • 9.24: 9.24.1.27 and 9.24.10.1

Fixed FTD releases

  • 7.0 and earlier: 7.0.11
  • 7.2: 7.2.13
  • 7.4: 7.4.9
  • 7.6: 7.6.7
  • 7.7: 7.7.14
  • 10.0: 10.0.3
  • 10.1: 10.1.1

Why it matters

Edge firewalls and VPN concentrators are among the most attractive targets on the internet today. They are exposed by design, they cannot run endpoint agents, and they sit in front of everything else. A reliable unauthenticated crash is valuable to an attacker on its own: it cuts remote staff off, breaks site-to-site links and can be timed to cover other activity. It also signals that someone has been studying this VPN code path very closely.

The timing is uncomfortable for Cisco customers. In the same week, the vendor disclosed that a sophisticated threat group it tracks as UAT-11473 had weaponised CVE-2026-20127, an authentication bypass in Catalyst SD-WAN Controller, against space and satellite, defence and aerospace, and policy-research organisations. That campaign deployed a custom malware framework named KeyDrift, built to run inside SD-WAN control-plane processes and quietly harvest encryption keying material. Cisco assesses that the infrastructure overlaps with Volt Typhoon's Silent Train network, but that remains an assessment rather than a confirmed attribution. The two flaws are technically unrelated, yet together they show how much pressure the Cisco network edge is under right now.

What to do

  1. Patch first. Upgrade to the fixed release for your branch using the lists above. There is no configuration change that fully closes the hole.
  2. Check whether you are exposed. On ASA, if the tunnel-group list is enabled, inspect every tunnel group, including DefaultWEBVPNGroup, for a secondary authentication server group. If the list is disabled, still inspect DefaultWEBVPNGroup: switching the list off does not remove exposure when the default group uses secondary authentication. On FTD, review the deployed remote-access VPN policy and the resulting running configuration in FMC or FDM.
  3. Mitigate if you cannot patch today. Disable the tunnel-group list when DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on the affected tunnel groups and on the default group. Weigh the temporary loss of a second factor against the risk of an outage, and do not leave it that way for long.
  4. Look back for unexplained reloads. Pull crash information and reload history across your ASA and FTD fleet and correlate it with VPN connection attempts from unusual sources. Any unexplained reboot since early October deserves a closer look.
  5. Reduce reachability. Where the business allows, restrict the SSL VPN portal to known source ranges or place it behind IP or geographic filtering. What an attacker cannot reach, they cannot crash.

VPN portals, management interfaces and forgotten edge appliances are exactly the assets that drift out of sight between audits. 4tify's Attack Surface Management continuously maps what your organisation really exposes to the internet and flags vulnerable firmware versions as soon as advisories like this one land, so a flaw such as CVE-2026-76418 is on your team's radar the day it is published.

SHARE