Cisco has disclosed an actively exploited zero-day in the Remote Access SSL VPN component of its ASA and FTD firewalls. Reachable before authentication, the flaw reloads the appliance and drops every VPN connection.
On 28 October 2026 Cisco disclosed a zero-day flaw in its enterprise firewall software that is already being exploited in real attacks. Tracked as CVE-2026-76418, the vulnerability sits in the Remote Access SSL VPN component of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD), and carries a CVSS 3.1 score of 8.6, rated high severity.
The root cause is a logic error that becomes reachable when secondary authentication is configured on a tunnel group. An attacker does not need valid VPN credentials: a single crafted connection request is enough to make the appliance reload unexpectedly. Cisco's product security team (PSIRT) confirmed it became aware of exploitation during October 2026. No public proof-of-concept exploit has been released so far.
Why it matters
This flaw does not allow remote code execution or data theft. Its impact is on availability — which, in a production network, is a distinction without much comfort. When the appliance reloads, every active remote-access session drops along with any site-to-site VPN tunnels terminating on that device. For a company whose branch or warehouse link runs through that firewall, this means the data path to head office simply stops. And because the vulnerable code path is reached before authentication, strong passwords and multi-factor policies offer no protection.
The affected range is wide: ASA releases 9.16 through 9.24, and FTD releases 7.0 through 10.1. Cisco states that Cloud-delivered Firewall, cdFMC, Cisco Secure Access and Secure Firewall Management Center are not affected. Two conditions must both be true for a device to be exposed: webvpn enabled on at least one interface, and a secondary authentication server group configured on a tunnel group or on DefaultWEBVPNGroup.
What this means for SMEs
Secondary authentication is a common configuration in business networks. Companies with remote staff, field teams or outsourced IT support use exactly this feature to add a second verification layer in front of the VPN. In other words, a setting adopted to improve security is what creates the attack surface in this particular case.
The practical problem in smaller companies is that firewall software often goes years without an update. As long as the box is passing traffic, nobody touches it and vendor bulletins go unread. Yet there is no complete workaround here. Cisco's interim measure is to temporarily remove secondary authentication, which itself lowers the security of VPN sign-in. Patching is the only durable fix.
What we recommend at Kamer Bilişim
- Confirm whether you are exposed at all. Review every tunnel group on the firewall — not just the ones listed on the login page — along with the DefaultWEBVPNGroup configuration. If no secondary authentication server group is defined and webvpn is off, this flaw does not apply to you.
- Apply the patch in a planned maintenance window. Cisco has published fixed releases for every branch: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 on ASA; 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 on FTD. Back up the running configuration before upgrading and keep a rollback step ready.
- Define a fallback path for critical links. If a branch or warehouse depends on a single firewall, having an alternative access route ready — a second line, or a separate remote-access channel — materially shortens the outage when the device reloads.
If you are not certain which software version your firewalls are running, or you want help planning the upgrade, we provide on-site and remote support across the Anatolian side of Istanbul. You can reach us through our contact page.
Source: SecurityOnline, SOC Prime, Cisco Security Advisory (cisco-sa-asa-ftd-vpn-dos)
Source: SecurityOnline