Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using

Cisco is urging customers to upgrade Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software after it found attackers exploiting a new flaw in the remote access SSL VPN. The bug, CVE-2026-76418, lets an unauthenticated attacker on the internet make an exposed firewall reboot. There is no workaround, and Cisco says the only full fix is a software upgrade.

The company published its security advisory at 19:15 GMT on 28 October. It rates the flaw high, with a CVSS score of 8.6. “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” the advisory says. Italy’s national cyber agency, ACN, issued its own alert on the morning of 29 October, marking exploitation as present and rating the systemic impact as critical.

Fixed releases to upgrade to

Cisco lists these first fixed releases. If you run an older train, upgrade to the release shown for it or later.

Secure Firewall ASA Software

• 9.16 and earlier: 9.16.4.104
• 9.18: 9.18.4.96
• 9.20: 9.20.4.50
• 9.22: 9.22.3.200
• 9.23: 9.23.1.48
• 9.24: 9.24.1.27 or 9.24.10.1

Secure Firewall Threat Defense (FTD) Software

• 7.0 and earlier: 7.0.11
• 7.2: 7.2.13
• 7.4: 7.4.9
• 7.6: 7.6.7
• 7.7: 7.7.14
• 10.0: 10.0.3
• 10.1: 10.1.1

Cisco “strongly recommends” upgrading and points customers to its Software Checker to confirm the right release for each device. Cloud-delivered Firewall, cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are not affected, the advisory says.

Which firewalls are exposed

A device is only vulnerable when three things are true at once. It runs an affected ASA or FTD release. Its SSL remote access VPN login service is reachable. And secondary authentication is configured on a tunnel group, the profile that decides how VPN users log in. Hardware listed by Cisco runs from the ISA 3000 and ASA 5500-X to the Firepower 1000, 2100, 4100 and 9000 series, Secure Firewall 1200, 3100 and 4200 appliances and the virtual ASAv and Firepower NGFW Virtual.

The cause, Cisco says, is “logic errors when secondary authentication is configured on a tunnel group”. An attacker sends a crafted request while connecting to the VPN and the device reloads. The advisory adds: “A successful VPN login is not required to reach the affected processing path.” In other words, the attacker needs no stolen password.

Administrators should check every tunnel group for the “secondary-authentication-server-group” setting, including the default group, DefaultWEBVPNGroup. Cisco warns that turning off the group list on the login page does not remove the exposure if the default group still uses secondary authentication. On FTD, the check is done in the deployed remote access VPN policy in Secure Firewall Management Center or Device Manager.

A stopgap, not a workaround

For firewalls that cannot be upgraded straight away, Cisco describes a mitigation. If the default group does not use secondary authentication, administrators can disable the group list with “no tunnel-group-list enable”. Otherwise, they can remove secondary authentication from the affected groups. Cisco cautions that the second option means “the security posture is lowered for remote access VPN”, because users lose a login factor. It treats both as temporary steps until the upgrade.

Cisco says the flaw was found by Eric Fernald while resolving a Cisco Technical Assistance Center support case. It has not said who is exploiting it, how many devices have been hit, or whether the attacks do anything beyond rebooting the firewall. The advisory describes only a denial of service.

Why a reboot bug on the edge matters

TSN’s analysis: a crash-only flaw can sound minor, but the device here is the front door. When a firewall that terminates remote access reloads, every VPN session drops and, for the minutes it takes to come back, staff cannot reach internal systems. An attacker who can repeat the request on demand can keep doing that. Reboots can also serve a quieter purpose: they clear in-memory state and can cover for other activity, which is one reason defenders treat repeated unexplained reloads on edge devices as an incident, not a nuisance.

This is the second Cisco ASA and FTD zero-day of its kind since August. CISA added the earlier one, CVE-2026-20349, to its Known Exploited Vulnerabilities catalogue on 11 August. The new flaw was not yet on that list in CISA’s 28 October update. Once it is, US federal agencies will face a deadline to patch.

The pattern fits a long run of attacks on edge gear. Palo Alto Networks has dealt with an exploited PAN-OS flaw and ransomware gangs reusing an older GlobalProtect bug. Lumen says China-linked Volt Typhoon used at least four zero-days to get into networks, and US agencies say SafePay ransomware got in through old, unpatched flaws. BeyondTrust patched a remote support zero-day attackers had already used.

What regulated firms should log

For banks, payment firms and crypto businesses, remote access is a control their supervisors expect to stay available and auditable. Firms should record when each firewall was upgraded or mitigated, keep any crash or reload logs from October onwards, and note any period when secondary authentication was switched off as a stopgap. That record matters if an outage later has to be explained to a regulator, or if a reload turns out to be part of a wider intrusion.

Sources

• Cisco: Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN denial of service vulnerability, cisco-sa-asaftd-tunnel-dos-s6mgkb75 (28 October 2026)
• ACN / CSIRT Italia: Cisco: rilevato sfruttamento in rete della CVE-2026-76418, AL01/261029/CSIRT-ITA (29 October 2026, Italian)
• CSIRT Italia on X (29 October 2026)
• CVE.org: CVE-2026-76418 record
• CISA: Known Exploited Vulnerabilities catalogue
• SecurityWeek: Attackers exploit second Cisco firewall VPN zero-day since August (29 October 2026)

Related stories

• Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access
• Palo Alto Networks Says a PAN-OS Flaw Is Being Exploited, and CISA Adds It to Its Must-Patch List
• SafePay Ransomware Hit 600 Victims via Old Flaws, Agencies Warn