Attackers Are Crashing Cisco Firewalls Through Their VPN Login Page: The Three Conditions, the Fixed Versions and the Stopgap
Cisco has patched CVE-2026-76418, a flaw in ASA and Firepower Threat Defense remote access VPN that attackers are already using to force firewalls to reboot without logging in. Here is how to tell if your firewall is exposed, which releases fix it and what to do if you cannot upgrade tonight.
If your office VPN runs through a Cisco firewall, a stranger on the internet may be able to restart it at will. Cisco on Wednesday shipped fixes for CVE-2026-76418, a bug in the remote access SSL VPN service of its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, and said it already knew of attacks using it. Every forced reboot drops connected VPN users and interrupts traffic through the firewall until it comes back up.
The details below come from SecurityWeek’s report on the second exploited Cisco VPN flaw since August, with the version list taken from The Hacker News and exposure figures from BleepingComputer.
The flaw at a glance
- Identifier: CVE-2026-76418, rated 8.6 out of 10 (high).
- Products: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software.
- Where it sits: the remote access SSL VPN service, in how tunnel groups that use secondary authentication are processed.
- What an attacker gets: a forced reload of the device, which is a denial of service. Cisco has not said the bug allows data theft or code execution.
- Login needed: none. According to Cisco, an attacker never has to sign in to the VPN to hit the faulty code; a specially crafted request during the connection attempt does the job.
- Exploited: yes. Cisco’s product security team learned of attacks in October but has not named the attackers, the targets or shared indicators of compromise.
- Not affected: Secure Access, Secure Firewall Management Center and Cisco’s cloud-hosted firewall and management services, per SecurityWeek.
- How it surfaced: during a Cisco support (TAC) case. Cisco credits Eric Fernald with the find.
Are you exposed? All three must be true
- The firewall runs an ASA or FTD release older than the fixed versions listed below.
- Its SSL remote access VPN login service can be reached, which for most remote-work setups means from the internet.
- At least one tunnel group has secondary authentication turned on. Cisco says to check every tunnel group if the tunnel group list is enabled, and to check the built-in default group, DefaultWEBVPNGroup, in every case, because turning the list off leaves you exposed if that default group still relies on secondary authentication.
FTD owners should look at the remote access VPN policy as deployed, and the running configuration it produces, in Secure Firewall Management Center or Firepower Device Manager.
For scale: more than 51,000 internet-facing Cisco ASA SSL VPN devices show up in Shadowserver Foundation scans, though BleepingComputer notes it does not say how many are already secured or are honeypots.
First fixed releases
ASA Software:
- 9.16 and earlier: 9.16.4.104
- 9.18: 9.18.4.96
- 9.20: 9.20.4.50
- 9.22: 9.22.3.200
- 9.23: 9.23.1.48
- 9.24: 9.24.1.27 and 9.24.10.1
FTD Software:
- 7.0 and earlier: 7.0.11
- 7.2: 7.2.13
- 7.4: 7.4.9
- 7.6: 7.6.7
- 7.7: 7.7.14
- 10.0: 10.0.3
- 10.1: 10.1.1
If you cannot upgrade tonight
Cisco says there is no true workaround, but exposure can be reduced. If DefaultWEBVPNGroup does not use secondary authentication, you can turn off the tunnel group list. Otherwise, you can remove secondary authentication from the affected tunnel groups. Cisco itself warns that dropping secondary authentication makes remote access weaker and recommends upgrading instead, so treat this as a short bridge, not a fix.
Why this is a pattern, not a one-off
Within roughly two months, attackers have now used two different zero-days to knock ASA and FTD devices offline. In August, Cisco fixed CVE-2026-20349, an HTTP request handling bug that also let unauthenticated attackers trigger a reload through the same remote access VPN service. Cisco shared no attack details then either, and it is not known whether the same group is behind both.
What this means for your company
For many small and mid-size businesses, the firewall is also the front door for every remote employee. A flaw that only causes reboots may sound minor, but repeated crashes can cut off remote staff, disrupt phones and cloud apps, and create noise that hides other activity. Whatever brand of firewall you use:
- Know exactly which firmware version each firewall runs and who is responsible for updating it.
- Put VPN and firewall updates on a short, defined timeline when a vendor says a flaw is being exploited.
- Write down your VPN settings, including any secondary authentication, so you can quickly answer “are we affected?”
- Alert on unexpected firewall reboots and keep the logs somewhere other than the firewall itself.
- Have a fallback plan for remote work if the VPN is down for a day.
Not sure what firmware your firewall is running or how it is configured for remote access? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
