A flaw in Cisco's ASA and Secure Firewall Threat Defense software lets an unauthenticated attacker force the firewall to reload. Cisco confirmed the bug was being exploited in the wild in October 2026.
Cisco has disclosed a vulnerability affecting the remote access SSL VPN service in Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, both widely deployed at the edge of corporate networks. Tracked as CVE-2026-76418, the flaw allows an unauthenticated remote attacker to send a crafted request that forces the firewall to reload unexpectedly. Cisco rates it 8.6 on the CVSS v3.1 scale, and its PSIRT team confirmed it became aware of active exploitation in October 2026.
What triggers the flaw
The root cause is a set of logic errors in the remote access SSL VPN service. Two conditions have to be true at the same time for a device to be exposed: webvpn must be enabled on at least one interface, and secondary authentication (secondary-authentication-server-group) must be configured on any tunnel group or on DefaultWEBVPNGroup. Cisco's advisory states plainly that a successful VPN login is not required to reach the affected processing path, which means the attacker needs no valid credentials at all.
According to Cisco's list, ASA releases 9.16 through 9.24 and FTD releases 7.0 through 10.1 are affected. Cloud-delivered Firewall, cdFMC and Secure Access are not. Fixed builds include ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14 and 10.0.3.
Why it matters
This is a denial of service issue, not a data theft one. But when a perimeter firewall reloads, far more than VPN users are affected: internet egress, site-to-site links between branches and, in many designs, server access all go down with it. Because the attacker can simply repeat the request, the device can reload again and again, which in practice looks like a sustained outage rather than a brief glitch.
Cisco says no complete workaround exists. The only mitigation until patching is to remove secondary authentication from tunnel groups. The US Cybersecurity and Infrastructure Security Agency also added the flaw to its Known Exploited Vulnerabilities catalog on 6 November 2026.
What this means for businesses in Türkiye
From manufacturing plants to maritime and logistics operators, from office buildings to clinics, a large share of mid-sized companies in Türkiye run branch connectivity and remote work over ASA or FTD based SSL VPN. Secondary authentication is usually enabled precisely to strengthen security, yet it is that configuration which exposes the device here. In other words, organisations that invested in stronger VPN authentication are the ones most likely to be affected.
There is a compliance angle too. Article 12 of Türkiye's Personal Data Protection Law No. 6698 requires data controllers to take appropriate technical measures to keep personal data secure, and availability is part of that. Leaving a publicly disclosed, already patched vulnerability open for months can be read as a failure to apply a required technical measure.
What we recommend at Kamer Bilişim
- Confirm the exposure conditions before scheduling the patch. Check whether webvpn is enabled on any interface and whether secondary authentication is configured on any tunnel group. If both are true, the device is in scope. Compare your running version against Cisco's list of fixed releases.
- Apply Cisco's mitigation during the window before patching. Removing secondary authentication is the only mitigation Cisco offers. Because it weakens multi-factor login, keep it short, document it, and restrict VPN access by source IP for the same period wherever possible.
- Separate the VPN interface from management and watch for reloads. Firewall management should never be reachable from the internet, and syslog plus uptime monitoring should be in place. An unexplained reload is the first and often the only symptom of this flaw.
If you need help inventorying your firewalls, identifying affected devices and planning a patch window with minimal downtime, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Cisco Security Advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75), CISA Known Exploited Vulnerabilities Catalog, Cyber Security Agency of Singapore Alert AL-2026-159
Source: Cisco PSIRT / CSA Singapore