Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Ravie LakshmananOct 29, 2026Vulnerability / Network Security Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. According to Cisco, the issue is rooted in the Remote Access SSL VPN service of ASA and FTD software. "This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group," it said in a Wednesday advisory. "An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition." The network equipment major said it became aware of active exploitation of this vulnerability in October 2026, but did not share any specifics as to when the attacks began, who is behind them, and the scale of the efforts. Fixes for the flaw are available in the following versions - Cisco Secure Firewall ASA Software Release Cisco also noted that the vulnerability affects Cisco devices if the following conditions are met - They are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software. The SSL remote access VPN login service is reachable. Secondary authentication is configured in the tunnel group scope. "If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group," Cisco said. "If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, check the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication." As a temporary mitigation, the company is recommending that customers turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup. "On Cisco Secure FTD Software, review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM," Cisco said. "A successful VPN login is not required to reach the affected processing path." The disclosure comes as Cisco revealed that a sophisticated advanced persistent threat (APT) actor tracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypass authentication and gain unauthorized access to affected systems. The activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network. "UAT-11473 then installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts," Cisco Talos said. "The framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, cybersecurity, network security, Vulnerability Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them