Cisco Patches Actively Exploited VPN Flaw That Can Knock Firewalls Offline

Cisco has released patches for a high-severity vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The flaw, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scale. Cisco says it has been exploited in the wild. An unauthenticated attacker anywhere on the internet could cause an affected device to reload unexpectedly, creating a denial-of-service condition.

The problem sits in the Remote Access SSL VPN service. Cisco says it stems from logic errors when secondary authentication is configured on a tunnel group, and an attacker can trigger it by sending a crafted request when connecting to the VPN. Cisco notes that a successful VPN login is not required to reach the affected processing path. The company said it became aware of active exploitation in October 2026, but it has not shared when the attacks began, who is behind them, or how widespread they are.

Whether a device is exposed depends on its configuration. Cisco advises checking tunnel groups, including the default group DefaultWEBVPNGroup, for a secondary authentication server group. Turning off the group list does not remove the exposure if the default group uses secondary authentication. As a temporary measure, Cisco recommends disabling the tunnel group list if the default group does not use secondary authentication, or disabling secondary authentication on affected tunnel groups. FTD users should review their remote access VPN policy and running configuration in Cisco Secure FMC or FDM. This article covers only the opening of the source report.