Cisco has released patches for a high-severity flaw in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that attackers are already exploiting to crash devices remotely. The vulnerability, tracked as CVE-2026-76418, carries a CVSS score of 8.6. Cisco said its Product Security Incident Response Team became aware of active exploitation during October 2026, and it strongly recommends that customers upgrade to a fixed release.

Attackers crash firewalls without logging in

The flaw sits in the Remote Access SSL VPN service and stems from logic errors when secondary authentication is configured on a tunnel group. An attacker sends a crafted request while connecting to the SSL remote access VPN, and the device reloads unexpectedly, cutting off remote access in a denial-of-service condition. No successful VPN login is needed to reach the affected code path. Devices are exposed when they run vulnerable ASA or FTD software, have SSL VPN enabled on at least one interface, and use a configuration containing the "webvpn" keyword with secondary authentication on a tunnel group. Cisco has not named the attackers, the organisations targeted, or the scale of the attacks, and it has reported no confirmed data theft or remote code execution from this flaw.

Who is affected and how the flaw works

Fixed releases include ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Internet-facing VPN gateways should be patched first. Administrators who cannot patch immediately can reduce exposure by disabling secondary authentication on the DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list, though Cisco warns this weakens VPN login security. Unexpected reloads and crash files on VPN gateways should be treated as a warning sign and investigated.

What administrators should do now

Sources: BleepingComputer, The Hacker News.