Cisco ASA and FTD firewalls: SSL VPN flaw under active attack

On 28 October 2026 Cisco published a security advisory covering a flaw in Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. The issue, tracked as CVE-2026-76418, carries a CVSS 3.1 score of 8.6. Cisco's PSIRT team confirmed the flaw was used in real attacks during October, and CISA added it to its Known Exploited Vulnerabilities catalogue on 29 October 2026, giving federal agencies until 1 November to patch. A window that short signals ongoing exploitation.

What the flaw actually does

The weakness sits in the logic that handles secondary authentication on the remote access SSL VPN service. An attacker who can reach the device from the internet, holding no credentials at all, can send a crafted request to the VPN login interface and force the firewall to reload. Repeated, the request can push the device into a continuous reboot loop.

Cisco's assessment is that the flaw does not allow data theft or code execution on the device; the impact is limited to loss of availability. That is not the same as low risk. In most organisations this single appliance carries the internet gateway, the branch links and remote staff VPN access. When it goes down, the office and the field team go offline with it.

Which devices are affected

According to Cisco, three conditions have to be true at the same time for a device to be exposed:

• It runs an unpatched ASA or FTD release
• The remote access SSL VPN login service is reachable from outside (the configuration has webvpn enabled)
• Secondary authentication is configured on a tunnel group — including the default DefaultWEBVPNGroup when the tunnel group list is enabled

Cloud-delivered Cisco Secure Access, Cloud-delivered Firewall and Secure Firewall Management Center are not affected. Fixes shipped in ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, and in FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. There is no full workaround; Cisco offers only a temporary measure — switching secondary authentication off — which weakens VPN authentication in exchange.

What this means for businesses in Türkiye

Many mid-sized companies here run perimeter security and remote access through a single enterprise firewall, then leave it on the same software release for years on a "don't touch what works" basis. This flaw is a reminder that an attacker needs no password — only a VPN interface exposed to the internet.

The technical measures expected under Article 12 of Law No. 6698 cover not only preventing unauthorised access to data but also keeping data and systems available. A multi-hour network outage in a production plant, a logistics operation or a clinic is both an operational loss and an incident to be explained on the compliance side.

What we recommend at Kamer Bilişim

• Build the inventory first, then plan the patch. If you cannot state in writing which firewall brand, model and software release is running in your organisation, patch management is not possible. If you run ASA or FTD, compare your running version against Cisco's published list of fixed releases.
• Do not leave the VPN interface open to the whole world. Where remote access is genuinely needed, narrow the surface with geographic restrictions, known IP ranges and session limits. Management interfaces should never be reachable from the internet.
• Rehearse the outage before it happens. Who responds when the firewall goes down, whether a backup internet line exists and whether a current configuration backup is on hand should be settled in advance, not during the incident. Keeping configuration backups regularly and off the device cuts recovery from hours to minutes.

If you would like your firewall and VPN configuration reviewed, a version inventory produced, or a patch plan prepared, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: Network World, SOC Prime, Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75