What the flaw does

Cisco's advisory describes a fault in the Remote Access SSL VPN service used by its Secure Firewall ASA and Secure Firewall Threat Defense software. When secondary authentication is set up for a tunnel group, errors in the handling of that process can be triggered by a crafted connection request. A remote attacker does not need to log in successfully to reach the faulty path, which is why the issue matters even for organisations that believe their VPN login screen is holding.

The practical effect is a denial of service rather than a takeover. A successful request can make the affected device reload without warning, taking its firewall and VPN services offline until it comes back up. For a site that depends on that single device for remote access, even a short outage can interrupt staff working from home and break connections to internal systems.

Who is affected and what to check

The flaw only bites where a particular combination is present. The device must be running a vulnerable release, the SSL VPN login service must be reachable, and secondary authentication must be configured in an affected tunnel group. Cisco's guidance points administrators to look for the webvpn setting and for secondary authentication settings, including on the default tunnel group, when deciding whether their configuration is exposed.

Cisco has said its cloud-delivered firewall offerings and its management centre product are not affected by this flaw. That distinction matters for teams sorting out which parts of their estate need urgent attention and which can wait for a routine maintenance window.

Fixes, deadlines and temporary steps

Fixed releases are available across the supported ASA and FTD trains, including ASA 9.20.4.50 and FTD 7.4.9 as examples from the advisory summaries. Administrators should match their own train to the first fixed release listed by Cisco for that train, rather than assuming a version number from another train will apply.

The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October 2026, with a 1 November remediation date for US federal civilian agencies. That date binds those agencies only, but it signals how urgently the flaw is being treated. Where an immediate upgrade is not possible, Cisco's temporary step is to disable secondary authentication on the affected tunnel groups — a trade-off that removes a layer of authentication, so it should be treated as a stopgap, not a fix.

Sources: The Hacker News