Cisco Firewall VPN Flaw Is Being Used to Knock Firewalls Offline: What to Check

If your business uses a Cisco firewall running ASA or Firepower Threat Defense (FTD) software, and your team connects to the office through Cisco's SSL remote access VPN, this one is worth a look today. On October 28, 2026, Cisco published a fix for a flaw, tracked as CVE-2026-76418, and said it is aware of attackers actively using it. CISA added it to its list of vulnerabilities known to be exploited on October 29.

The short version: if you use the Cisco SSL VPN with a second sign-in step configured, update the firewall to a fixed version. Until then, Cisco describes a temporary mitigation.

What the flaw does

According to Cisco's advisory, an attacker on the internet, without any username or password, can send a specially crafted request to the VPN login service and make the firewall restart unexpectedly. Cisco rates it High, with a severity score of 8.6. It does not give the attacker access to your network or data, but each restart drops your internet connection, your VPN users and anything else that runs through the firewall, and an attacker can repeat it.

Who is at risk

• Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) devices running a version below the fixed releases in Cisco's advisory.
• Only when the SSL remote access VPN is turned on and reachable, and secondary authentication (a second authentication server on the VPN connection profile) is configured. Cisco's advisory explains how to check, including the default profile, DefaultWEBVPNGroup.
• Cisco says its cloud-delivered firewall, cloud-delivered management center, Secure Access and Secure Firewall Management Center software are not affected.

What to do now

1. Update the firewall. Cisco has listed fixed releases for every supported version line, for example ASA 9.18.4.96, 9.20.4.50 and 9.22.3.200, and FTD 7.2.13, 7.4.9 and 7.6.7. Check the advisory or Cisco's Software Checker for the right one for your device, and plan a short maintenance window since the firewall will restart.
2. If you can't update right away, use Cisco's mitigation. Cisco says there is no full workaround, but turning off secondary authentication on the affected connection profiles, or turning off the connection profile list on the login page in some setups, removes the exposure. Cisco notes this can lower your VPN security, so test it and treat it as temporary.
3. Watch for unexpected restarts. If your firewall has rebooted on its own recently, mention it to whoever manages it.

Questions to ask your IT provider

1. Do we have a Cisco ASA or FTD firewall, and which software version is it running?
2. Is our SSL VPN turned on, and does any connection profile use secondary authentication?
3. When can we schedule the update to a fixed release?