Cisco patches VPN crash flaw it says attackers exploited

Cisco has released fixes for CVE-2026-76418, a high-severity firewall vulnerability it says attackers have exploited to trigger unexpected restarts and interrupt service. Internet-monitoring platform Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices, but that is not a count of vulnerable or compromised systems.

The flaw affects certain configurations of Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. It concerns their remote-access virtual private network (VPN) service, which lets users connect to a network remotely. Cisco published its advisory on 28 October and said it learned of active exploitation in October 2026, as The Hacker News said on 29 October. Cisco has not disclosed when the attacks began, their scale or who is responsible.

The vulnerability scores 8.6 on the Common Vulnerability Scoring System (CVSS). Cisco says logic errors occur when secondary authentication—an additional authentication check—is configured on a tunnel group, or VPN connection profile. An attacker can send a specially crafted request to the SSL remote-access VPN service and cause an unexpected restart, producing a denial of service. A successful VPN login is not required.

Shadowserver counts more than 51,000 exposed devices, not necessarily vulnerable

BleepingComputer said on 29 October that Shadowserver tracks more than 51,000 Cisco ASA devices with SSL VPN services exposed to the internet. The count does not separate devices that have already been secured or honeypots—decoy systems.

The figure measures internet exposure, not confirmed vulnerability to CVE-2026-76418 or successful attacks. Administrators still need to check the software version and VPN configuration to determine whether a device is affected.

Which deployments need action

Cisco says a device is affected only when all three conditions apply:

• It runs a vulnerable ASA or FTD software release.
• Its SSL remote-access VPN login service is reachable.
• Secondary authentication is configured in the relevant tunnel group.

To check whether the VPN service is enabled, Cisco tells administrators to look for webvpn in the running configuration, with enable <interface_name> under it on at least one interface. Administrators must also check the software release, reachability and secondary-authentication conditions.

• If tunnel-group-list enable is configured, check every tunnel group, including the default group, DefaultWEBVPNGroup, for secondary-authentication-server-group. Include groups that are not displayed in the login page’s profile list.
• If the list setting is absent or has been removed, still check DefaultWEBVPNGroup for secondary authentication. Disabling the list does not remove exposure when that default group uses secondary authentication.

For FTD, Cisco says to review both the deployed remote-access VPN policy and the resulting device running configuration. In Secure Firewall Management Center (FMC), VPN settings are under Devices > VPN > Remote Access. In Secure Firewall Device Manager (FDM), use Remote Access VPN.

Cisco lists Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software as unaffected by this vulnerability.

Fixed releases by software branch

Cisco lists the following first fixed releases. Administrators should choose the appropriate update for their software branch.

Temporary mitigations and their trade-offs

Cisco offers two temporary configuration mitigations, depending on whether the default tunnel group uses secondary authentication:

• If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel-group list by entering no tunnel-group-list enable in WebVPN configuration mode. Users will lose the provided connection-profile selection list and must know which profile to use.
• If DefaultWEBVPNGroup uses secondary authentication, remove it with no secondary-authentication-server-group. Disabling the list alone is insufficient. Cisco warns that removing secondary authentication lowers remote-access VPN security.

Cisco says the mitigation succeeded in a test environment, but administrators should evaluate its effectiveness and possible effects on functionality, performance and security in their own deployments before applying it.

The configuration changes are temporary measures, not a software fix. Cisco strongly recommends upgrading to an appropriate fixed release to remove the vulnerability and avoid the exposure described in its advisory.