Vulnerabilities
Cisco fixes VPN firewall flaw that let attackers disrupt devices
Cisco has patched a zero-day flaw in its firewall VPN software that let attackers remotely force devices to restart, disrupting network access. The bug affects ASA and FTD products using secondary authentication.
Ross Grant2 min read
The short version
Cisco found and fixed a serious bug in its firewall VPN software. Attackers could use this bug to make the firewall restart, which would cut off network access for users. The problem only affects certain Cisco firewall models and only if they use a specific VPN setting. Cisco recommends updating to the latest version to stay protected.
What happened?
Cisco has patched a zero-day flaw in its Secure Firewall ASA and FTD software that let attackers remotely force devices to restart, disrupting network access. The bug, tracked as CVE-2026-76418, affects systems using secondary authentication in their VPN service. Cisco learned in October that the flaw was being exploited. No information has been shared about the attackers or the scale of the attacks.
How the flaw works
Cisco released a fix for a vulnerability (CVE-2026-76418) in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw is in the Remote Access SSL VPN service and has a CVSS score of 8.6, which means it is considered high severity. Attackers could exploit it remotely, without needing to log in, to force the firewall to restart. This would disrupt network access for anyone relying on the device.
The bug comes from logic errors in how the software handles tunnel groups that use secondary authentication. A tunnel group is a set of VPN settings applied to users or devices. Secondary authentication means users must provide a second proof of identity, such as a code or another password. Attackers could send a specially crafted request during the VPN connection process to trigger the flaw. Cisco said that a successful VPN login is not needed to reach the vulnerable part of the system.
Who is affected
The vulnerability affects Cisco ASA and FTD firewalls running unpatched software, with the SSL VPN login service exposed and using secondary authentication in at least one tunnel group. Cisco’s cloud-delivered firewall, Secure Access, and Secure Firewall Management Center are not affected. The issue was discovered during a Cisco support case and reported by Eric Fernald. Cisco learned in October that attackers were exploiting the flaw in the wild, but has not shared details about the attacks or who was behind them. SecurityWeek (opens in a new tab)
The response
Cisco has released patches to fix the vulnerability. There are no workarounds that fully address the issue. Customers can reduce their risk by disabling the tunnel group list or removing secondary authentication from affected tunnel groups, but Cisco warns that removing secondary authentication makes VPN access less secure. The company recommends upgrading to the fixed version instead.
Has this happened before?
This is the second time in recent months that attackers have exploited a zero-day flaw in Cisco’s firewall VPN software for denial-of-service (DoS) attacks. In August, Cisco patched CVE-2026-20349, another bug in the SSL VPN service that let unauthenticated attackers remotely restart devices. Cisco has not said whether the same attackers are behind both incidents.
Claimed vs confirmed
- Unconfirmed
Attackers are actively exploiting CVE-2026-76418 in Cisco ASA and FTD firewalls.
Only SecurityWeek has reported exploitation, and Cisco has not released a public statement.
Why it matters
This flaw let attackers disrupt business networks by forcing firewalls to restart, even without logging in. Many companies rely on Cisco firewalls for secure remote access, so a flaw like this can cause real downtime. The fact that this is the second such flaw in a few months highlights the need for regular patching and careful VPN configuration.
Key points
- Cisco patched a zero-day flaw in ASA and FTD firewall VPN software.
- Attackers could force devices to restart remotely, disrupting access.
- The flaw affects systems using secondary authentication in VPN tunnel groups.
- No workaround fully fixes the issue; patching is required.
- This is the second similar Cisco VPN flaw exploited in recent months.
Sources
SecurityWeek
Reference
