CYBUNKR

Cisco firewall VPN flaw exploited to knock firewalls offline

Published

Cisco says attackers are exploiting CVE-2026-76418 in ASA and FTD firewalls: one crafted request to the SSL VPN login can make the firewall reload, no login needed. CISA added it on 29 October. Who is exposed and what to patch.

If your office firewall is a Cisco ASA or Firepower (FTD) and staff connect to it with AnyConnect or Secure Client VPN, check it today. Cisco says CVE-2026-76418 lets an attacker who has not logged in send a crafted request to the SSL VPN and make the firewall reload, and that it became aware of active exploitation in October (Cisco). While a firewall reloads, the office usually loses its internet connection and everyone on the VPN is cut off.

On 29 October CISA added it to its Known Exploited Vulnerabilities catalog and gave US federal agencies until 1 November to fix it. Cisco rates it 8.6 out of 10 (CVE record).

Who is affected

A firewall is vulnerable when all three of these are true (Cisco):

  • It runs a vulnerable release of Cisco Secure Firewall ASA or Secure Firewall Threat Defense (FTD).
  • The SSL remote access VPN login is reachable (webvpn enabled on an interface).
  • Secondary authentication (secondary-authentication-server-group) is set on a tunnel group, including the default DefaultWEBVPNGroup. Cisco notes the attacker does not need a successful VPN login.

Cisco's cloud-delivered firewall, cloud-delivered FMC, Secure Access and the FMC management software itself are not affected (Cisco).

What has been seen so far

A snapshot from 30 October:

  • Cisco published its advisory on 28 October and says its PSIRT became aware of active exploitation in October. The flaw was found while resolving a Cisco support case.
  • Threat feed Previdian listed it as exploited on 28 October, a day before CISA.
  • CISA's assessment in the CVE record rates exploitation as “active” and automatable. Neither Cisco nor CISA has said who is behind it.

What to do

  • Upgrade. First fixed ASA releases: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. First fixed FTD releases: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cisco's Software Checker shows the right one for your version.
  • Until you can, Cisco lists a mitigation, not a workaround: if DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list (no tunnel-group-list enable); if it does, remove secondary authentication. Removing it weakens VPN sign-in, so test first (Cisco).
  • Watch for unexpected reloads of the firewall and VPN drop-outs, and raise a case with your IT provider or Cisco if you see them.
  • If an IT provider manages your firewall, ask which ASA or FTD version it runs, whether secondary authentication is used on the VPN and when the fix will be installed.

How we can help

Not sure whether your firewall is affected or patched? Get in touch.

Sources