US cyber agency lists Cisco firewall flaw as actively exploited

The US Cybersecurity and Infrastructure Security Agency (CISA) added Cisco firewall flaw CVE-2026-76418 to its Known Exploited Vulnerabilities catalogue on 29 October 2026, citing evidence of active exploitation, The Hacker News said.

Cisco had already said its security response team became aware of exploitation in October 2026. The flaw can allow a remote attacker who has not logged in to trigger an unexpected device restart, causing a denial of service—an interruption to the device’s service.

Which firewalls are affected

The flaw affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Affected devices have the “webvpn” keyword in their configuration and SSL VPN remote access enabled on at least one network interface, BleepingComputer said. A VPN is a virtual private network used here for remote access.

Cisco says the flaw arises from logic errors when secondary authentication—an additional identity check—is configured on a VPN tunnel group. An attacker can exploit it by sending a specially crafted request while connecting to the SSL remote-access VPN.

The vulnerability has a Common Vulnerability Scoring System (CVSS) severity score of 8.6 and is rated high severity.

Updates and temporary mitigation

Cisco has released security updates and strongly recommends that customers upgrade to a fixed software release to address the vulnerability.

Administrators unable to patch immediately can mitigate the flaw by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on user-configured tunnel groups, BleepingComputer said. It described this as mitigation, while saying Cisco provided no workaround that fully addresses the issue.

Cisco has not publicly identified the attackers or targeted organizations, or disclosed how many organizations were targeted.

The Hacker News describes 1 November 2026 as a recommended date for Federal Civilian Executive Branch agencies to apply fixes, rather than a binding deadline.