Attackers Actively Exploit Cisco ASA and Secure Firewall Flaw

The Cyber Security Agency of Singapore issued an alert on 4 November 2026 warning that attackers are actively exploiting a high-severity vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD). Tracked as CVE-2026-76418, the flaw carries a CVSS v3.1 score of 8.6 out of 10. Due to logic errors in the Remote Access SSL VPN service when secondary authentication is configured, an unauthenticated remote attacker can send a crafted request causing affected devices to reload unexpectedly, resulting in a denial of service.

Key Facts

How Does the Remote Access VPN Flaw Operate?

The vulnerability stems from logic errors within the Remote Access SSL VPN service on affected Cisco devices. When secondary authentication is enabled for a tunnel group, an unauthenticated remote attacker can transmit a specially crafted request directly to the service. This causes the appliance to reload unexpectedly, creating a persistent denial of service.

Under affected configurations, the flaw completely disrupts network connectivity. Because the vulnerability is triggered prior to authentication completion, any remote actor with network visibility into the SSL remote access VPN service can crash the system repeatedly.

An unauthenticated remote attacker can crash vulnerable Cisco ASA and FTD devices by sending a crafted request to the Remote Access SSL VPN service when secondary authentication is configured.

Which Cisco Products and Software Versions Are Affected?

The security issue impacts multiple releases of Cisco Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense. Cisco has confirmed that attackers are actively exploiting the vulnerability in production environments. Administrators must inspect their running configurations, as only setups using secondary authentication on remote access SSL VPN tunnel groups face immediate disruption.

Affected Cisco ASA Software releases include versions before 9.16.4.104, versions 9.18.0 to before 9.18.4.96, versions 9.20.0 to before 9.20.4.50, versions 9.22.0 to before 9.22.3.200, versions 9.23.0 to before 9.23.1.48, versions 9.24.1 to before 9.24.1.27, and version 9.24.10. For Cisco Secure FTD, affected releases comprise versions before 7.0.11, versions 7.2.0 to before 7.2.13, versions 7.3.0 to before 7.4.9, versions 7.6.0 through 7.6.7, versions 7.7.0 to before 7.7.14, versions 10.0.0 to before 10.0.3, and version 10.1.0.

Cisco has confirmed active in-the-wild exploitation targeting specific unpatched releases of Cisco ASA Software and Cisco Secure Firewall Threat Defense.

What Should You Do?

• Update affected Cisco ASA Software and Cisco Secure FTD devices to the latest versions immediately.
• Review the vendor advisory to verify the full list of affected versions and guidance for your environment.
• Report any suspected security incidents or anomalous device reboots to the Cyber999 Incident Response Centre operated by MyCERT.

Common Questions

What causes the denial of service condition?

The denial of service is caused by logic errors in the Remote Access SSL VPN service. When secondary authentication is configured for a tunnel group, an unauthenticated attacker can send a crafted request that causes the appliance to reload unexpectedly without valid credentials.

Is this Cisco vulnerability being actively exploited?

Yes, Cisco has confirmed active exploitation of CVE-2026-76418 in the wild. Threat actors are targeting vulnerable devices running the Remote Access SSL VPN service with secondary authentication enabled, making immediate patching essential to protect network availability.

Does the attacker need valid login credentials to attack?

No, authentication is not required to trigger this vulnerability. An unauthenticated remote attacker can exploit the logic flaw by transmitting a specially crafted request across the network, forcing the targeted Cisco firewall or gateway to shut down and reboot.

Sources and Methodology

This dispatch was prepared based solely on the official alert published by the Cyber Security Agency of Singapore on 4 November 2026 regarding CVE-2026-76418. No other documents, vendor advisories, or external sources were reviewed or verified for this report.