Cisco firewall flaw lets attackers crash VPNs: update now
In short: Cisco has fixed a high-severity flaw (CVE-2026-76418) in its ASA and Firepower Threat Defense firewall software that lets an attacker on the internet make the firewall restart, without logging in. It only affects devices with SSL VPN switched on, but Cisco says it has already been used in real attacks. Network teams should install the fixed software now.
What happened
On 29 October, Cisco warned about a zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, the operating systems that run many company firewalls and remote-access VPNs. The flaw, tracked as CVE-2026-76418, is rated high severity. Cisco's security team says it became aware of active exploitation in October, which is why it is called a zero-day: attackers were using it before a fix was available. If the term is new, see our explainer on zero-day vulnerabilities.
What the flaw does
An attacker who can reach the firewall over the internet, with no username or password, can send it specially crafted traffic that makes it reload (restart) unexpectedly. Cisco says the cause is a logic error when secondary authentication is set up on a VPN tunnel group.
A restart may sound harmless, but while the firewall reboots, every remote worker on the VPN is disconnected, and some sites may lose their internet connection. An attacker who repeats the attack can keep a company offline. This is a denial-of-service attack: it does not steal data, but it stops people working.
Who is affected
Only devices running ASA or FTD software with the webvpn feature configured and SSL VPN enabled on at least one interface, which is the common set-up for staff working from home. The Shadowserver Foundation tracks more than 51,000 Cisco ASA SSL VPN devices reachable from the internet, although it is not known how many are vulnerable.
What it means for you
If you are a home user, there is nothing to do. If you look after a company network, or you are studying for CCNA or Security+, this is a textbook example of why internet-facing devices such as VPN gateways and firewalls must be patched first. Our note on patch management explains how to prioritise, and how a VPN works explains what is at stake.
What network teams should do
- Check whether your ASA or FTD devices have SSL VPN (
webvpn) enabled. The Cisco ASA commands note lists the show commands. - Upgrade to a fixed software release from Cisco's advisory. Cisco says there is no workaround that fully removes the risk.
- If you cannot patch straight away, Cisco suggests turning off secondary authentication on the DefaultWEBVPNGroup tunnel group and on any tunnel group you created, as a temporary measure.
- Watch firewall logs and monitoring for unexpected reloads, and plan a maintenance window for the upgrade.
Key takeaways
- CVE-2026-76418 lets an attacker on the internet make Cisco ASA and FTD firewalls restart without logging in.
- Only devices with SSL VPN (webvpn) enabled are affected, but attackers were using it before the fix.
- Each restart disconnects VPN users, so repeated attacks can keep a company offline.
- Upgrade to a fixed release; turning off secondary authentication is only a stop-gap.
Understand the basics
New to this topic? These short FM TecHub guides explain the ideas behind this story.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.