Cisco has rolled out fixes for a critical vulnerability affecting its Secure Firewall ASA and Secure FTD software after confirmation that the flaw is being actively exploited. Tracked as CVE-2026-76418, the issue scores 8.6 on the CVSS scale and enables unauthenticated remote attackers to crash firewalls by triggering a denial‐of‐service via the SSL VPN service. If successful, the device can unexpectedly reload, disrupting network operations.
How the Vulnerability Works
The weakness stems from logic miscalculations in how secondary authentication is handled for tunnel groups. Specifically, when a tunnel group is set up beyond basic authentication—requiring a secondary auth factor—an attacker can send a specially crafted request during SSL remote access VPN connection attempts, forcing the affected device to crash. Cisco states that exposure exists even before any VPN login is completed, meaning attackers don’t need valid credentials to hit the flaw.
Affected Versions & Mitigations
The flaw impacts ASA and FTD devices under several conditions: a vulnerable software release, reachable SSL remote access VPN service, and configured secondary authentication in the tunnel group scope. Additionally, special configuration of the “tunnel‐group‐list enable” or relying on the default tunnel group (DefaultWEBVPNGroup) can leave systems exposed if they use secondary authentication. Disabling these features or removing secondary authentication are suggested stopgap measures.
Cisco has released patches for specific versions. For ASA users, fixed versions include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 / 9.24.10.1. For FTD software, patched updates include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
Cisco first became aware of active misuse of the vulnerability in October 2026, though the company did not clarify how long attacks have been occurring, the identity of the attackers, or how widespread the exploitation is.
This advisory arrives alongside details about a different breach: a state-sponsored group known as UAT-11473 used CVE-2026-20127 to bypass authentication on SD-WAN Catalyst Controller systems, gaining access across sectors like defense, aerospace, and policy research. The same threat actor deployed a malware suite named KeyDrift, designed for long-term persistence, key theft, and network control. Notably, its infrastructure shares overlap with another campaign dubbed Silent Train.
Security teams using ASA or FTD software should immediately verify their system versions and configuration. If secondary authentication is enabled anywhere in tunnel groups—or in DefaultWEBVPNGroup—they need to either update to patched software or disable impacted features as a temporary guardrail. For FTD deployments, particular scrutiny should be applied to remote access VPN policies in the centralized management tools.
Why it matters: SSL VPNs serve as critical access points—including for remote workers and third-party integrations—and this vulnerability shows how complex configurations, especially those involving multi-factor or secondary authentication, can open unexpected attack paths. In this case, an attacker lacking credentials can still force denial of service, underlining the importance of both secure defaults and timely patching in network defense.
