Cisco has released security patches for a critical vulnerability affecting its Secure Firewall ASA and FTD software that has been actively exploited by attackers. The flaw, identified as CVE-2026-76418 and rated 8.6 in severity, resides in the Remote Access SSL VPN service and stems from logic errors when secondary authentication is configured. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request to cause the affected device to restart unexpectedly, creating a denial-of-service condition that disrupts firewall operations.
Cisco became aware of active exploitation attempts in October 2026 but provided no details about when attacks began, who is responsible, or their scope. The company has released patches across multiple software versions and identified three conditions that must be met for devices to be vulnerable: running a susceptible software release, having the SSL VPN login service accessible, and having secondary authentication configured in the tunnel group. As temporary protection, Cisco recommends customers disable the tunnel group list or secondary authentication on affected configurations until patches can be applied.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
