Cisco has issued updates to rectify a significant security issue in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. This flaw, which has already been exploited in real-world scenarios, poses a serious threat to network security.
Understanding the Vulnerability
The identified vulnerability, designated as CVE-2026-76418, carries a high severity rating of 8.6 on the CVSS scale. This flaw can be exploited by an unauthenticated remote attacker, potentially causing the affected devices to restart unexpectedly, leading to a denial-of-service (DoS) situation. The problem lies within the Remote Access SSL VPN service of ASA and FTD software.
According to Cisco’s advisory, the vulnerability stems from logic errors when secondary authentication is set up on a tunnel group. Attackers can exploit this by sending a specially crafted request, which could result in the device reloading and causing a DoS condition.
Exploitation and Mitigation Details
Cisco became aware of the active exploitation of this vulnerability in October 2026. However, details regarding the timeline of these attacks, the attackers involved, or the extent of these efforts remain undisclosed.
Patches for the vulnerability are available in specific versions of ASA and FTD software. For ASA, the fixes range from version 9.16.4.104 through 9.24.10.1, depending on the release. FTD software patches are available from version 7.0.11 to 10.1.1.
Devices are vulnerable if they are running the affected versions of Cisco Secure Firewall ASA or FTD Software, have the SSL remote access VPN login service accessible, and have secondary authentication configured within the tunnel group scope.
Recommendations for Users
Cisco advises users to review all tunnel groups, including the default group, DefaultWEBVPNGroup, for secondary authentication configurations. If the tunnel-group-list is disabled, users should verify the default tunnel group’s settings to mitigate exposure.
The company suggests temporarily disabling the tunnel group list if the DefaultWEBVPNGroup does not utilize secondary authentication or removing secondary authentication from any configured tunnel group list.
Additionally, for Cisco Secure FTD Software, users should examine the deployed remote access VPN policy and the device’s running configuration in Cisco Secure FMC or FDM Software.
Broader Security Concerns
The announcement coincides with Cisco’s disclosure of an advanced persistent threat (APT) actor, identified as UAT-11473, exploiting another vulnerability, CVE-2026-20127, in Cisco SD-WAN Catalyst Controller instances. This actor has targeted sectors such as space and satellite services, defense, aerospace technology, and policy research, using a custom malware framework named ‘KeyDrift’ to gain unauthorized access and exfiltrate sensitive information.
This framework includes components like PolyFlame and LittleFilch, designed for collecting sensitive keying information and maintaining persistent access. KeyDrift operates by intercepting and extracting keying material from decrypted control traffic within SD-WAN processes, ensuring long-term infiltration capabilities.
