Cisco firewalls: attackers are knocking some VPNs offline, update now if you use one

Cisco has fixed a flaw in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) firewalls that lets someone on the internet make the firewall restart, with no password needed. Cisco says attackers are already doing this. While the firewall restarts, staff working from home lose their VPN (the secure link back to the office) and the office can lose its internet.

Only if your business has a Cisco ASA or FTD firewall, staff connect in through its SSL VPN, and the VPN is set to check a second login (Cisco calls this secondary authentication). All three have to be true.

If you don't know what firewall you have, ask whoever looks after your network. Cisco's Software Checker lists the hardware this software runs on, including the ASA 5500-X, the Firepower 1000, 2100, 4100 and 9000 Series, the Secure Firewall 1200, 3100 and 4200 Series, and the ASAv virtual firewall. Cisco says its cloud-delivered firewall, Secure Access and Secure Firewall Management Center are not affected.

1. Ask your IT person or provider: "Do we have a Cisco ASA or FTD firewall with the SSL VPN switched on, and does any connection profile use secondary authentication?"
2. If yes, ask them to update it to the first fixed version Cisco lists for your branch (for example ASA 9.22.3.200 or FTD 7.4.9). Cisco's free Software Checker shows the fix for any release number.
3. If it can't be updated straight away, Cisco gives a stopgap your IT person can apply, depending on how the VPN is set up: hide the list of connection profiles on the VPN login page, or switch off secondary authentication on the default profile. Cisco says it worked in its own tests, but warns that it can lower the VPN's security or change how people log in, and it still says to update.
4. If you notice the VPN dropping out or the firewall restarting for no reason, tell them, as that is what this attack looks like.

Is it being attacked? Yes. Cisco says it learned of active exploitation in October 2026 (advisory of 28/10/2026). The US agency CISA added it to its known exploited list on 29/10/2026 and gave US federal agencies until 01/11/2026 to fix it. Cisco hasn't published details of the attacks or signs to look for.

People. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco Technical Assistance Center (TAC) support case. The advisory doesn't mention Ai.

• CVE and scoring: CVE-2026-76418, CWE-690 (unchecked return value to NULL pointer dereference), CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), scored by Cisco. Cisco bug ID CSCwx26625. Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, version 1.0 Final, first published 28/10/2026 19:15 GMT, unchanged when re-checked on 31/10/2026.
• Cause, per Cisco: logic errors when secondary authentication is configured on a tunnel group. A crafted request when connecting to the SSL remote access VPN reloads the device. A successful VPN login is not required to reach the affected path.
• Vulnerable when: the release is vulnerable, the running config has webvpn with enable <interface_name> on at least one interface (the SSL VPN login is reachable), and secondary authentication is in scope. If tunnel-group-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group; Cisco notes this is not limited to the profiles shown on the login page. If tunnel-group-list enable is absent or was removed, check DefaultWEBVPNGroup, because disabling the group list does not remove exposure when the default group uses secondary authentication. On FTD, review the deployed remote access VPN policy (FMC: Devices > VPN > Remote Access; FDM: Remote Access VPN) and the resulting running config.
• First fixed releases (copied from the advisory). ASA: 9.16 and earlier 9.16.4.104; 9.18 9.18.4.96; 9.20 9.20.4.50; 9.22 9.22.3.200; 9.23 9.23.1.48; 9.24 9.24.1.27 and 9.24.10.1. FTD: 7.0 and earlier 7.0.11; 7.2 7.2.13; 7.4 7.4.9; 7.6 7.6.7; 7.7 7.7.14; 10.0 10.0.3; 10.1 10.1.1.
• Workarounds: none. Mitigation, per Cisco (proven in a test environment; evaluate it for your own network first): if DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list with no tunnel-group-list enable in WebVPN configuration mode, after which users must know their connection profile name. If DefaultWEBVPNGroup does use secondary authentication, remove it with no secondary-authentication-server-group, which lowers the remote access VPN's security posture. Cisco treats both as temporary until the upgrade.
• Not vulnerable, per Cisco: Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA) and Secure FMC Software.
• Exploitation: Cisco PSIRT became aware of active exploitation in October 2026; the advisory publishes no indicators of compromise and names no attacker. CISA KEV: added 29/10/2026, federal due date 01/11/2026, known ransomware use "Unknown" (catalogue 2026.10.30, checked 31/10/2026).

• Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, first published 28/10/2026, checked 31/10/2026
• Cisco Software Checker, checked 31/10/2026
• CVE.org record CVE-2026-76418, published 28/10/2026, checked 31/10/2026
• CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30, checked 31/10/2026
• NCSC news, checked 31/10/2026 (nothing on this flaw)