Cisco firewall VPN flaw exploited to crash devices
Attackers are using a Cisco ASA and FTD flaw to force firewalls to restart. Who is affected, the fixed releases and what a small office should do.
If your office firewall is a Cisco ASA or a Cisco Secure Firewall running FTD, and your staff connect to the office over Cisco's remote access VPN, there is an update to install. On October 28, 2026, Cisco disclosed CVE-2026-76418, a flaw that lets an attacker on the internet make the firewall restart, without a password. Cisco says it is already being exploited, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of known exploited vulnerabilities on October 29.
What the flaw does
According to Cisco's security advisory, an unauthenticated, remote attacker can cause the device to reload unexpectedly. It is a denial-of-service flaw: Cisco does not say it lets anyone in or steal data. But each reload drops the internet connection for the whole office and disconnects everyone on the VPN, and an attacker can repeat it. Cisco rates it High, with a CVSS score of 8.6, and says its security team became aware of active exploitation in October. It has not said who is behind the attacks.
BleepingComputer notes it is the second exploited flaw of this kind in these firewalls since August, when Cisco fixed CVE-2026-20349, and cites Shadowserver tracking more than 51,000 Cisco ASA SSL VPN devices exposed online. CISA's deadline for federal agencies to fix it was November 1.
Is your firewall affected?
Cisco says a device is vulnerable when all three of these are true:
- it runs an affected ASA or FTD software release;
- the SSL remote access VPN login service is reachable;
- secondary authentication is configured on a VPN tunnel group, for example a second login server used for two-step sign-in.
If nobody connects to your office over the Cisco VPN client or web portal, the flaw does not apply. If you are not sure how the VPN was set up, ask whoever installed the firewall, or check the configuration for the "secondary-authentication-server-group" setting in each tunnel group, including the default one.
What to do
- Find the software version on the firewall and compare it with the fixed releases in Cisco's advisory. For example, ASA 9.20 is fixed in 9.20.4.50 and 9.22 in 9.22.3.200, and FTD 7.4 in 7.4.9 and 7.6 in 7.6.7. Older releases have their own fixed versions listed.
- Plan the upgrade for a quiet hour, because the firewall restarts. Save a copy of the configuration first, and have someone on site in case it does not come back cleanly.
- If you cannot upgrade straight away, Cisco describes a temporary mitigation. It depends on whether the default VPN group uses secondary authentication, and one version weakens VPN security, so treat it as a stopgap only.
- Watch for unexplained restarts. If the office has had sudden internet drops or the VPN has kicked everyone off recently, check the firewall's logs for reloads.
- Check support status. If the firewall is too old to receive the fixed release, that is a sign it is time to replace it.
Keeping remote staff working
Because this flaw disrupts rather than breaks in, the business risk is downtime: remote staff locked out, cloud apps unreachable from the office, phones that depend on the internet going quiet. It is worth knowing who would restart the firewall and how staff would carry on if it went down during the working day.
Earlier this month we covered a different exploited firewall flaw in SonicWall's SSL-VPN MFA bypass. Our network setup and management and patch management services keep office firewalls updated and monitored. If you would like us to check your Cisco firewall, call (213) 986-4855.