Science & Tech · Cybersecurity · 3 hrs ago
Cisco patches exploited flaw that can crash firewall devices
Cisco released patches for a flaw in its ASA and FTD firewall software after finding that attackers were exploiting it.
The flaw affects devices running certain software versions with the SSL remote access VPN service reachable and secondary authentication configured.
An attacker can send a crafted request without logging in and make a vulnerable firewall reload, disrupting its service.
Cisco says the issue comes from logic errors in how secondary authentication is handled for VPN connections.
The flaw matters because it can interrupt firewall protection, though the available information does not identify the attackers, targets or scale of the activity.
Cisco recommends installing the fixed software versions; customers who cannot patch immediately can reduce risk by disabling secondary authentication in the affected tunnel groups.
Administrators need to check their VPN and tunnel group settings to determine whether their devices are exposed.
Cisco released patches for a high-severity flaw in its ASA and FTD firewall software that attackers have exploited to crash devices.
The vulnerability, tracked as CVE-2026-76418, can let unauthenticated remote attackers cause affected firewalls to reload and become unavailable.
It affects devices with SSL remote access VPN enabled and secondary authentication configured in a tunnel group.
Cisco said it became aware of active exploitation in October 2026 but did not identify the attackers or targeted organizations.
Cisco recommended upgrading to fixed software and provided temporary mitigation steps for customers unable to patch immediately.
- Who
- Cisco released the patches; attackers are exploiting the flaw. Their identities are not stated.
- What
- A flaw in Cisco ASA and FTD software can let remote attackers crash firewall devices.
- When
- Cisco said it became aware of active exploitation in October 2026. The reports were published on October 29, 2026.
- Where
- On affected Cisco ASA and FTD firewall devices with reachable SSL remote access VPN services.
- Why
- Logic errors involving secondary authentication in a tunnel group create the vulnerability. The attackers’ reasons are not stated.
This story does not have two clearly opposing sides.
Cisco said its Product Security Incident Response Team became aware of active exploitation of the vulnerability.
Cisco’s patches were reported by BleepingComputer and The Hacker News.
- Vulnerability
- CVE-2026-76418
- Severity
- High; CVSS score 8.6
- Affected products
- Cisco ASA and FTD software
- Attack impact
- Unauthenticated remote attackers can cause affected devices to reload, resulting in denial of service.
- Exposure condition
- SSL remote access VPN service is reachable and secondary authentication is configured in a tunnel group.
3 sources
What people are saying
This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition
A successful VPN login is not required to reach the affected processing path.