Cisco patches actively exploited ASA and FTD VPN flaw that crashes firewalls

Cisco has released software updates for an actively exploited vulnerability in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) products that lets an unauthenticated attacker crash internet-facing firewalls, according to a company advisory covered by The Hacker News, BleepingComputer and SecurityWeek on October 28-29, 2026. Cisco said it became aware of active exploitation attempts in October 2026, though it did not disclose when the attacks began, who is behind them, or how widespread they are.

What happened

The flaw, tracked as CVE-2026-76418 and rated 8.6 on the CVSS scale, sits in the Remote Access SSL VPN service of ASA and FTD software. According to Cisco's advisory, the root cause is "logic errors when secondary authentication is configured on a tunnel group." An unauthenticated remote attacker can send a crafted request that makes the device reload, producing a denial-of-service condition. Cisco noted that a successful VPN login is not required to reach the affected code path. SecurityWeek described it as the second Cisco firewall VPN zero-day exploited since August.

Who is affected

Cisco said a device is exposed when three conditions hold at once: it runs a vulnerable release, the SSL VPN login service is reachable, and secondary authentication is configured in a tunnel group. Because ASA and FTD devices frequently sit at the network edge to terminate remote-access VPNs, an outage can cut off remote workers and disrupt connectivity for the organizations that rely on them.

Technical details

Per Cisco, the issue stems from how the SSL VPN service handles secondary authentication logic, and the crash can be triggered before authentication completes. The company did not publish indicators of compromise or exploit details in the material reviewed, and the reporting did not attribute this specific CVE to any named threat actor. The Hacker News noted that in the same timeframe Cisco also addressed a separate SD-WAN issue, CVE-2026-20127, which is unrelated to this VPN flaw.

What to do

Cisco urged administrators to install the fixed releases. According to the advisory, ASA branches are addressed in versions such as 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, while FTD fixes land in releases including 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. As a temporary measure where patching is not immediately possible, Cisco advised either disabling the tunnel group list when the DefaultWEBVPNGroup does not use secondary authentication, or disabling secondary authentication on user-configured tunnel groups and the default group. Cisco warned that disabling the group list alone does not remove exposure if the default group still uses secondary authentication, and recommended FTD administrators review the remote access VPN policy and running configuration through FMC or FDM.