Cybersecurity Threat Advisory: Exploited Cisco Firewall Flaw Can Knock Your VPN Offline

Threat update

Cisco has confirmed that attackers are actively exploiting a high-severity flaw in Cisco Secure Firewall ASA and Firepower Threat Defense (FTD). Tracked as CVE-2026-76418 (CVSS 8.6), the bug lets anyone on the internet send a crafted request to your VPN login page and force the firewall to reboot. No username or password needed. Keep sending those requests and the firewall keeps going down, taking your remote workers, branch connections, and anything else behind it along for the ride. CISA added this one to its Known Exploited Vulnerabilities catalog on October 29. If you run Cisco firewalls with SSL VPN, it belongs at the top of this week's patch list.

Technical Detail and Additional Info

What is the threat?

CVE-2026-76418 lives in the Remote Access SSL VPN feature of Cisco ASA and FTD software. Cisco traces it to logic errors that show up when secondary authentication (for example, a second RADIUS, LDAP, or Duo server group) is configured on a VPN tunnel group. Here's what that means in practice:

• No login required: The attacker never has to authenticate. They just need to reach the public SSL VPN login page and send a specially crafted connection request.
• The result is a reload: When the firewall processes that request, it crashes and restarts. While it's rebooting, VPN tunnels drop and any traffic the device handles stops.
• Repeatable: Attackers can keep sending requests to hold the device in a denial-of-service loop.
• Availability only: Cisco rates the impact as denial of service. There's no indication that data is read or changed through this bug.

A device is affected only if all three of these are true:

1. It runs a vulnerable ASA or FTD release.
2. The SSL remote access VPN login is reachable (on ASA, webvpn with SSL VPN enabled on an interface; on FTD, remote access VPN enabled in FMC or FDM).
3. Secondary authentication (secondary-authentication-server-group) is configured on any tunnel group.

That last point has a catch. Cisco warns that the built-in DefaultWEBVPNGroup counts, even if it doesn't appear on your login page and even if you've disabled the tunnel group list. A lot of shops have settings on that default group they forgot about years ago.

Cisco credits Eric Fernald with finding the issue during a TAC case. Cisco has not shared who is behind the attacks, how widespread they are, or when they began. Cisco Cloud-delivered Firewall, cdFMC, Secure Access, and Secure FMC are not affected. 

Why is it noteworthy?

Your firewall is the front door, and your VPN is how people get through it. When it goes down, remote staff can't work, branch offices lose their connection to headquarters, and in many cases internet access at the site goes with it. An attacker doesn't need to break in to cause real business pain here. They just need to keep the lights flickering.

A DoS can also be a distraction. Repeated reboots and failovers keep IT busy, can interrupt logging and monitoring, and create noise that hides other activity. It's worth noting that Cisco also disclosed this month that a state-backed group exploited a separate authentication bypass in Cisco SD-WAN Catalyst Controllers (CVE-2026-20127). Network edge gear is clearly in attackers' crosshairs right now.

Cisco ASA and FTD have been a repeat target. Exploited VPN flaws hit these platforms several times in 2025 and again earlier in 2026. Every time, the organizations that got hurt were the ones that patched late. 

What is the exposure or risk?

Organizations face the most risk when:

• Cisco ASA or FTD firewalls with SSL VPN are exposed to the internet and haven't been updated
• Secondary authentication is set on any tunnel group, including DefaultWEBVPNGroup
• There's a single firewall at the edge, or a high availability (HA) pair that hasn't been tested or where only one peer is patched
• Remote workers, branch offices, or customers rely on the VPN to reach business-critical systems
• No one is watching for unexpected reloads or crash events on firewall hardware

If attackers target your device, they could:

• Cut off remote access for employees and branch locations, sometimes for extended periods
• Disrupt every other service that passes through the firewall
• Trigger repeated HA failovers that leave the environment unstable
• Interrupt security monitoring and logging, giving cover for other attacks
• Cause lost productivity, missed SLAs, and real dollars lost while the business waits

What are the recommendations?

 LBT Technology Group recommends the following actions:

• Patch now, starting with internet-facing VPN gateways. Cisco's first fixed releases are:
  • ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1
  • FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1
  Use Cisco's Software Checker to confirm the right release for your device, since other advisories may apply too.
• Check every tunnel group. Look for secondary-authentication-server-group on all tunnel groups, especially DefaultWEBVPNGroup. On FTD, review the VPN policy and running configuration in FMC or FDM. Remove secondary authentication anywhere it isn't truly needed.
• Use Cisco's temporary mitigation if you can't patch today. If DefaultWEBVPNGroup doesn't use secondary authentication, run no tunnel-group-list enable in WebVPN configuration mode. If it does, removing secondary authentication from that group closes the gap but weakens your security posture. Test first, and treat this as a stopgap, not a fix.
• Shrink your exposure. Where possible, limit who can reach the VPN login page to expected countries or source networks, and never expose firewall management interfaces to the internet.
• Patch both HA peers and test failover. Make sure your HA pair is configured correctly and actually fails over under load. A half-patched pair is still a vulnerable pair.
• Watch for the warning signs. Alert on unexpected reloads, crash files, and sudden VPN drops, and compare them against spikes in traffic to the SSL VPN login. Cisco hasn't published indicators of compromise, so an unexplained reboot is your best clue. Open a TAC case if you see one.
• Don't forget the rest of the edge. If you run Cisco SD-WAN Catalyst Controllers, patch CVE-2026-20127 as well, and keep firewall, VPN, SD-WAN, and identity advisories at the top of your vulnerability management queue.

Not sure whether your Cisco firewalls are on a fixed release, or what's hiding in that default VPN group? Contact LBT Technology Group for a no-pressure review of your firewall and remote access security.

References

 For more in-depth information about the recommendations, please visit the following links:

• The Hacker News. "Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls." October 29, 2026.
• Rescana. "Cisco Secure Firewall ASA and FTD CVE-2026-76418: Exploited SSL VPN DoS Flaw Added to CISA KEV." October 2026.
• BleepingComputer. "New Cisco firewall zero-day exploited to crash SSL VPN devices." October 2026.