An attacker who can reach the VPN login page of a Cisco firewall, with no username and no password, can make that firewall reboot. Cisco says that is already happening.

On Oct. 28 Cisco published fixes for CVE-2026-76418, a high-severity flaw in the Remote Access SSL VPN service of its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. Cisco's advisory says its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. On Oct. 29 the Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog with a due date of Nov. 1, a three-day window for federal agencies, which is short for a patch deadline.

Cisco's advisory lists no workarounds. The fix is a software update.

What the bug does

Cisco's advisory, cisco-sa-asaftd-tunnel-dos-s6mgkb75, blames "logic errors" in the Remote Access SSL VPN code that show up when secondary authentication is configured on a tunnel group. A tunnel group is the ASA/FTD object that holds the settings for one set of VPN connections. Secondary authentication is a second credential check stacked on top of the first. Cisco says an unauthenticated, remote attacker who sends a crafted request when connecting to the SSL remote access VPN can make the affected device reload, which takes it offline for a while. That is a denial of service (DoS). Cisco also says a successful VPN login is not required to reach the affected processing path.

Cisco lists the weakness as CWE-690, an unchecked return value that leads to a NULL pointer dereference. Put simply, the code asks for something, never checks whether it got a valid answer, and then uses the empty result anyway. CISA's KEV entry names the flaw "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability."

The CVSS 3.1 base score is 8.6 (High), with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. In plain terms, the attack works over the network, is easy to carry out, needs no privileges or user interaction, and hits availability hard. It does not touch confidentiality or integrity. The "scope changed" element of the vector reflects that the impact reaches beyond the vulnerable component itself. The NVD record, published Oct. 28, carries the same score and vector, supplied by Cisco's PSIRT. Cisco tracks the issue internally as bug ID CSCwx26625.

Who is actually exposed

Not every ASA or FTD box is vulnerable. Per Cisco, a device is affected only if all of these are true:

  • It runs a vulnerable release of ASA or FTD software.
  • The SSL remote access VPN login service is reachable.
  • Secondary authentication is configured in the tunnel group scope.

Cisco's guidance on checking this is specific. If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup, for a secondary authentication server group. If the group list is absent or has been removed, still check DefaultWEBVPNGroup, because disabling the group list does not remove exposure when that default group uses secondary authentication. The check is not limited to profiles shown on the login page. On FTD, review the deployed remote access VPN policy and the resulting running configuration in Cisco Secure FMC or FDM.

What we know, and don't know, about the attacks

Very little. According to The Hacker News, Cisco said it became aware of active exploitation in October 2026 but gave no details on when the attacks began, who is behind them, or how widespread they are. Help Net Security likewise reported that Cisco confirmed the newly disclosed vulnerability has been exploited to crash devices. None of the sources attribute the activity to a particular group or nation.

CISA's KEV entry lists known ransomware campaign use as "Unknown." That is the agency's standard label when it has no evidence either way. It does not mean ransomware has been ruled out.

Why would anyone bother with an attack that "only" reboots a firewall? The sources don't say what these attackers are after. As a matter of reasoning, a firewall that can be knocked over on demand could cut a company's remote workforce off at a bad moment, and repeated reloads could amount to a sustained outage. Defenders should treat it as a serious availability risk in its own right.

The Hacker News also covered separate Cisco-related activity in the same report: Cisco Talos's tracking of an advanced persistent threat actor it calls UAT-11473, which per that report used CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller instances. Nothing in the sources links that campaign to the ASA/FTD exploitation, and readers shouldn't assume a connection.

Workarounds versus temporary mitigations

There is a wrinkle worth pointing out. Cisco's advisory says plainly that there are no workarounds, and Cisco "strongly recommends" upgrading to a fixed release. Yet The Hacker News reports that Cisco itself describes a temporary mitigation: turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on any user-configured tunnel group or on the default tunnel group.

Both can be true in a narrow sense. Removing the condition that triggers the bug is not the same as a fix, and pulling secondary authentication may weaken the login security you deliberately added. Treat any such change as a stopgap for a short window, decided by your own security team, and not as a replacement for patching.

What It Means for Defenders

Find out whether you're in scope. List every ASA and FTD device that runs Remote Access SSL VPN. For each one, check two things: whether the SSL VPN login service is reachable, and whether any tunnel group, including DefaultWEBVPNGroup, has secondary authentication configured. Devices that meet both conditions are your priority.

Patch to a fixed release. Cisco has released updates. Cisco's advisory and The Hacker News list these first fixed releases:

  • ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 / 9.24.10.1
  • FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1

Check the first-fixed release for your train against Cisco's advisory before you schedule the upgrade, since the vendor's page is the authoritative source.

Plan for the reboot either way. Upgrading a firewall means a maintenance window, and so does getting knocked offline by an attacker. Plan the upgrade so that remote users keep a path in.

Watch for unexplained reloads. Exploitation of this bug shows up as the device reloading. Cisco says exploitation was observed in October 2026, so if an internet-facing ASA or FTD has rebooted without a planned reason this month, treat it as a possible sign of exploitation and look at the device's crash and reload records. CISA's entry marks forensic triage as "No," which fits a DoS flaw with no reported data access, but an unexplained outage still deserves a look.

Mind the deadline if you're federal. CISA's KEV entry sets a due date of Nov. 1, 2026 and directs agencies to follow CISA's BOD 26-04 guidance on prioritizing security updates. Other organizations are not bound by that date, but a KEV listing is a clear signal of real-world exploitation, and it is reasonable to expect customers and partners to ask how quickly you closed it.

Don't strip MFA lightly. If you can't patch immediately and decide to disable secondary authentication as a stopgap, document the decision, keep the window as short as possible, and turn the second factor back on once you're on a fixed release.

Sources