Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco has released patches for a high-severity vulnerability in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The flaw, tracked as CVE-2026-76418 and rated 8.6 on the CVSS scoring system, has been exploited in the wild. Successful exploitation could let an unauthenticated, remote attacker cause an affected device to reload unexpectedly, resulting in a denial-of-service condition.

What the vulnerability affects

The issue is rooted in the Remote Access SSL VPN service of ASA and FTD software. Cisco said it is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit it by sending a crafted request when connecting to the SSL remote access VPN.

Affected conditions and mitigation

Devices are affected if they run a vulnerable release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope. Cisco advises checking all tunnel groups, including DefaultWEBVPNGroup, for secondary-authentication-server-group. As a temporary mitigation, customers can turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on affected tunnel groups.

Fixed versions

Fixes are available in ASA Software releases 9.16.4.104 for 9.16 and earlier, 9.18.4.96 for 9.18, 9.20.4.50 for 9.20, 9.22.3.200 for 9.22, 9.23.1.48 for 9.23, and 9.24.1.27 and 9.24.10.1 for 9.24; and in FTD Software releases 7.0.11 for 7.0 and earlier, 7.2.13 for 7.2, 7.4.9 for 7.4, 7.6.7 for 7.6, 7.7.14 for 7.7, 10.0.3 for 10.0, and 10.1.1 for 10.1.

Related Cisco disclosure

Cisco also said a sophisticated advanced persistent threat actor tracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypass authentication and gain unauthorized access. The activity targeted space and satellite services, defense and aerospace technology, and policy research sectors, and is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network. UAT-11473 installed a custom malware framework tracked as KeyDrift, with components such as PolyFlame and LittleFilch, to collect sensitive keying information and provide persistent access.

Sources: The Hacker News