Cisco patches actively exploited ASA and FTD VPN crash flaw
Original title: Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
Cisco released fixes for CVE-2026-76418 in Secure Firewall ASA and FTD after saying the Remote Access SSL VPN flaw was exploited in October 2026. A crafted connection can reload the device and cause a denial of service when secondary authentication is set on a tunnel group. Cisco did not name the attackers, start date or scale. Separately, Talos said UAT-11473 used CVE-2026-20127 to bypass authentication on SD-WAN Catalyst Controllers and install the KeyDrift framework.
Unconfirmed: Cisco did not say who exploited CVE-2026-76418, when attacks began, or their scale; Volt Typhoon overlap is an assessment.
- ASA fixes include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1.
- FTD fixes include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
- A successful VPN login is not required to reach the vulnerable path.
- Temporary mitigation is to disable secondary authentication or the tunnel-group list where applicable.
- KeyDrift components named by Talos include PolyFlame and LittleFilch.
Impact: Unauthenticated remote denial of service by reloading the firewall
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Secure Firewall ASA Software | 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24 when SSL remote access VPN and secondary authentication apply | 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1 |
| Cisco Secure Firewall Threat Defense Software | 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1 when the same VPN conditions apply | 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 |
| Cisco SD-WAN Catalyst Controller | — | — |
- 1.Install the fixed ASA or FTD release for the running train.
- 2.Disable secondary authentication, or the tunnel-group list, where Cisco’s temporary mitigation applies.
- 3.Review SD-WAN Catalyst Controllers for unauthorized access linked to CVE-2026-20127.
- Vendors
- Cisco
- Products
- Secure Firewall ASA SoftwareSecure Firewall Threat Defense SoftwareSD-WAN Catalyst Controller
- Threat actors
- UAT-11473Volt Typhoon
- Malware
- KeyDriftPolyFlameLittleFilch
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
From the original article
3 min read at thehackernews.com
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8. 6 on the CVSS scoring system.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.