Cisco has patched CVE-2026-76418, a zero-day flaw in the SSL VPN of its ASA and FTD firewalls that attackers are already exploiting to reboot them remotely without authenticating. It affects anyone with the VPN exposed to the internet and secondary authentication set on a tunnel group. Check your version today and update.
Key facts
- CVE-2026-76418, CVSS 8.6: remote, unauthenticated denial of service in the remote access SSL VPN service of Cisco Secure Firewall ASA and Secure FTD. The device reloads unexpectedly (The Hacker News).
- Cisco released patches on 29 October. Its PSIRT team learned of active exploitation in October but has shared no indicators of compromise and no details on who is attacking or whom.
- CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 29 October (CISA).
- Shadowserver tracks more than 51,000 Cisco ASA devices with SSL VPN exposed online, without saying how many are already patched (BleepingComputer).
- It is the second denial-of-service zero-day in these firewalls since August, after CVE-2026-20349.
Does it affect me if I use Cisco for remote work VPN?
If you use a Cisco ASA or Firepower (FTD) firewall for staff VPN or to link offices, it might. According to Cisco, the device is vulnerable when three conditions are met at once:
- It runs an affected version.
- The SSL VPN login service is reachable.
- Secondary authentication is configured at the tunnel group level.
The root cause is logic errors in that configuration. A crafted request when connecting to the SSL VPN is enough, and the attacker doesn't need a valid login to reach the vulnerable code path. If your IT provider manages the device, this question is for them. If you don't use Cisco, you're not affected.
Which version do I need?
Fixed ASA versions: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1.
Fixed FTD versions: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
If your device isn't on one of these versions or later within its branch, you need to update.
What if I can't patch today?
Cisco offers a temporary mitigation: disable secondary authentication on the default tunnel group (DefaultWEBVPNGroup) and on any user-configured group. If DefaultWEBVPNGroup doesn't use secondary authentication, the alternative is to disable the tunnel group list.
This has a cost: it weakens VPN access security. And, as BleepingComputer notes, Cisco offers no workaround that fully fixes the issue. It's a stopgap, not a solution.
What to do today
- Find out whether you have Cisco ASA or FTD. If you don't know, ask your IT provider today, in writing.
- Get the exact installed version and compare it with the fixed ones above.
- Confirm whether secondary authentication is configured on any tunnel group.
- If the version is vulnerable, schedule the update as soon as possible, even if it means a short outage after hours.
- If you can't update today, apply Cisco's mitigation and record that it's temporary.
- Check that the VPN interface isn't exposed to the internet without need.
- If the firewall has rebooted with no explanation, treat it as suspicious and alert your provider or INCIBE-CERT, which published a notice on multiple vulnerabilities in Cisco products on 29 October.
What it means for a small business
From what's been described, this flaw isn't for stealing data. It's for knocking the device over. But in a small business the firewall is often the only door: if it reboots again and again, remote staff lose the VPN and the office may lose internet access. For a 30-person company working remotely, that's a lost day.
What worries us most is the pattern. This is the second zero-day of this kind in these devices since August. If your firewall only gets updated when someone remembers, that's the real problem, not this specific CVE.
Our advice: treat the firewall as a critical asset with its own patch schedule. Ask your provider for a clear commitment on how quickly they patch exploited flaws and to tell you when they do. If nobody is watching it, this is exactly the kind of task worth outsourcing carefully; we cover it in our cybersecurity service.
Frequently asked questions
Can attackers steal data with this flaw?
Cisco describes it as denial of service: the device reloads unexpectedly. The main risk is losing your VPN and network.
Is the mitigation enough?
No. It's temporary, it weakens access security and Cisco offers no workaround that fully fixes the issue. You need to update.
How do I know if I've already been hit?
Cisco hasn't published indicators of compromise. The practical signal is firewall reboots nobody can explain.
Sources
- The Hacker News – Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- BleepingComputer – New Cisco firewall zero-day exploited to crash SSL VPN devices
- CISA – CISA Adds Two Known Exploited Vulnerabilities to Catalog
- INCIBE-CERT – Avisos (Múltiples vulnerabilidades en productos de Cisco, 29/10/2026)
