Cisco patches an actively exploited ASA and FTD VPN flaw

On October 28, 2026, Cisco patched a flaw in the software that runs some of its most widely deployed firewalls, and it did so with attackers already using it. CVE-2026-76418 sits in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software, and an unauthenticated attacker on the network can trigger it to reload the device, knocking it offline (The Hacker News). Cisco rates it 8.6 on CVSS. A day later, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, setting a remediation deadline of November 1 for federal civilian agencies. The device built to guard the edge is the one being knocked down.

What happened

Cisco's advisory describes CVE-2026-76418 as a vulnerability in the Remote Access SSL VPN service that "could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly," producing a denial of service. The root cause is narrow: "logic errors when secondary authentication is configured on a tunnel group," which the CVE record classifies as a null pointer dereference. A device is exposed when the webvpn keyword is set and SSL VPN is enabled on at least one interface, with a secondary authentication server group configured on a tunnel group, including the default group. A successful VPN login is not required to reach the vulnerable code, which is what makes it reachable from the open internet.

The impact is availability only. The flaw does not leak data or grant code execution; its CVSS vector records no confidentiality or integrity impact and a high availability impact. In practice that means an attacker can force the firewall to reboot, and repeat it, turning the appliance that terminates remote access into an outage switch.

Cisco said plainly that this is not theoretical: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The company did not share the scope of the attacks or any detail about who is behind them. There is no complete workaround. Cisco offers a mitigation, disabling secondary authentication, but recommends upgrading to a fixed release.

Why it matters

Network edge devices are where attackers keep returning, and the reason is structural. Firewalls, VPN concentrators, and email gateways are exposed to the internet by design, they sit in privileged positions between untrusted traffic and internal systems, and they often cannot run the endpoint tooling that would catch an intrusion elsewhere. A single reachable flaw in one of them can hand an attacker a foothold or, as here, an off switch.

The pattern is easy to see across a single month. Earlier in October, Fortinet warned of a critical flaw in FortiMail, CVE-2026-104286, rated 9.8, that attackers used for unauthenticated file writes, and CISA added it to the same KEV catalog (BleepingComputer). It is also not the first actively exploited SSL VPN denial-of-service flaw to hit Cisco's firewall line this year: the company disclosed a separate one, CVE-2026-20349, in August (The Hacker News). Different bugs, same lesson. The appliances organizations lean on to defend the edge are themselves a prime target, and the barrier is low when a flaw needs no credentials and no user interaction.

SOURCE: CISA KEV

A denial of service rarely draws the attention a data breach does, but the business effect is direct. When the VPN that carries remote work reloads on command, the people who depend on it are locked out, and a determined attacker can keep it that way.

A firewall protects the network only while it is running. A flaw that reloads it on demand turns the edge of the network into the softest point in it.

The attack-surface read

The patch is the straightforward part. The harder question is whether you know which Cisco firewalls you run, which have SSL VPN turned on, and which are reachable from the internet with secondary authentication configured. The exposure condition here is specific, so closing it means matching the CVE to real, reachable assets rather than to a vendor name on an inventory sheet. The devices that slip are almost always the ones a team forgot it owned: a branch-office appliance, an acquired network, a VPN left enabled for a project that ended.

That is the work of knowing your attack surface, an accurate and current picture of what you expose to the internet, so an advisory like this becomes a short list of hosts to fix instead of a guessing game. It also sets the order. When a flaw is unauthenticated, remote, and already exploited, the reachable instances come first and the internal ones can follow your normal cycle. That is vulnerability prioritization by real risk, not by severity score alone.

This is the premise Threatless is built on: AI-native exposure management that keeps the picture of what you expose current, because you cannot patch the device you did not know was reachable. Patch CVE-2026-76418 on the boxes an attacker can reach today. Then make sure you would see the next one.