Exploited Cisco firewall zero-day knocks SSL VPN appliances offline

On 28 October 2026 Cisco published a security advisory for a zero-day flaw that is already being exploited in its enterprise firewall software. Tracked as CVE-2026-76418, the vulnerability affects the remote access SSL VPN service in Secure Firewall ASA and Secure FTD. An unauthenticated attacker can reload the device with a single crafted request. Cisco rates it 8.6 on CVSS 3.1, in the "high" band.

What the flaw actually does

Cisco classifies the issue as CWE-690, a NULL pointer dereference caused by an unchecked return value. The attacker cannot read data or run code: Cisco marks both confidentiality and integrity impact as none. The entire impact sits on availability, with the appliance restarting unexpectedly. In practice that means the company's internet edge drops and remote staff lose their VPN session.

Not every appliance is exposed. Cisco says three conditions must be true at once: the device runs an affected release, the SSL VPN landing service is enabled on an interface, and secondary authentication is configured on a tunnel group that falls in scope. Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are not affected.

Why this is urgent

Cisco PSIRT confirmed the flaw was used in real attacks during October 2026. The US Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalogue on 29 October 2026 and set 1 November 2026 as the compliance deadline for federal agencies, an unusually short window by KEV standards.

There is no durable workaround. Cisco's suggested mitigations rely on removing secondary authentication, and by Cisco's own warning that lowers the security posture of the VPN. Patching is the only clean answer.

What this means for SMEs

ASA and FTD are common at the network edge of mid-sized companies, including across Türkiye. Many SMEs serve branch offices and field staff from the very same appliance, and they typically define their second authentication factor in exactly the secondary authentication slot this flaw depends on. A configuration chosen to improve security is what puts the device in scope here.

The outcome is downtime, not a data breach. For shipping agencies, logistics operators, construction offices and production sites that run on hourly commitments, a firewall rebooting again and again stops order, customs and dispatch flows outright. Turkish data protection law adds a second angle: Article 12 of the KVKK obliges data controllers to secure personal data, and leaving a published, exploited vulnerability unpatched is unlikely to look good in any later review.

What Kamer Bilişim recommends

• Inventory first, then patch. Check the running release with show version or through FMC, and confirm whether any tunnel group uses secondary authentication. Cisco's first fixed releases include 9.20.4.50, 9.22.3.200 and 9.24.1.27 on ASA, and 7.2.13, 7.4.9 and 7.6.7 on FTD. Schedule the upgrade outside business hours.
• Stop publishing the SSL VPN portal to the whole internet. If remote access only ever comes from Türkiye or from known address ranges, enforce geo and IP restrictions at the edge. Never expose the management interface.
• Write the outage playbook now. Who gets alerted when the firewall reloads, how does the backup line take over, and how do key staff connect in the meantime? Without written answers to those three questions, patch day turns into an incident.

If you are not sure whether your firewall is in scope, we can run the inventory check and plan the upgrade with you. Reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: SOC Prime; Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (28 October 2026) and the CISA Known Exploited Vulnerabilities catalogue.