Cisco has patched a firewall flaw that needs no credentials and no successful VPN login, only a reachable SSL VPN login page. Attackers were already using it before the fix shipped.
What happened
CVE-2026-76418 is rated 8.6 and sits in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense software. Logic errors in how secondary authentication is handled on a tunnel group mean a crafted request sent during the VPN connection attempt reaches a processing path that should be behind a successful login.
The result is a forced reload of the device, so the impact is availability: remote access drops, and any traffic inspection the firewall was doing stops with it. Cisco learned in October that the flaw was being exploited, and published fixed releases on 28 October. Cisco says no workarounds exist, and that this is the second ASA and FTD SSL VPN denial-of-service zero-day in a few months, after CVE-2026-20349 in August.
Who is affected
- Appliances running an unpatched ASA release from 9.16 through 9.24, or an FTD release from 7.0 through 10.1.
- Only devices with the SSL VPN login service reachable from the internet and a tunnel group configured with secondary authentication.
- Not affected: the cloud-delivered firewall and management services, Secure Access, and Secure Firewall Management Center.
What to do now
Upgrade to a fixed release. Disabling secondary authentication reduces exposure but weakens the VPN, so treat it as a stopgap only.
- Check whether the running configuration contains the webvpn keyword with SSL VPN enabled on an interface that faces the internet.
- Upgrade ASA to 9.20.4.50, 9.22.3.200, 9.23.1.48 or 9.24.1.27 depending on your train, and older trains to 9.16.4.104 or 9.18.4.96.
- Upgrade FTD to 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1 as applicable.
- Review logs for repeated VPN connect attempts followed by an unexpected reload, and check whether the device restarted outside a maintenance window.
- If you cannot patch immediately, restrict the VPN portal to known source ranges rather than opening it to the internet.
What this means for South African businesses
An unauthenticated reboot is not data theft, but on a single-firewall site it takes the office offline and cuts every remote worker at once, and repeated attempts turn that into sustained downtime. Local SMEs running remote access VPN on an ASA or FTD appliance are the exposed group, and many will not know whether secondary authentication is enabled on their tunnel group until someone reads the config. The real risk here is not the flaw itself but the multi-year-old firmware sitting behind an internet-facing login page.
Source: SecurityWeek's report on the exploited Cisco ASA and FTD zero-day, and Cisco's advisory for the fixed releases.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.