Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco has rolled out fixes for a high-severity flaw in its Secure Firewall ASA and Secure FTD software that the company confirms is already being exploited by attackers in real-world attacks. Tracked as CVE-2026-76418 (CVSS 8.6), the bug lies in the Remote Access SSL VPN component and stems from logic errors that occur when secondary authentication is set up on a tunnel group, letting an unauthenticated remote attacker send a specially crafted connection request that forces the appliance to reload and drop into a denial-of-service state. Cisco says it detected active abuse of the issue starting in October 2026 but hasn't disclosed attacker identity or attack volume. Patches are available across numerous ASA releases (from 9.16 through 9.24) and FTD releases (from 7.0 through 10.1), and until updates can be applied, admins are urged to disable the tunnel group list or turn off secondary authentication on affected tunnel groups, including the default DefaultWEBVPNGroup. The news follows Cisco's separate disclosure that the UAT-11473 threat group exploited another authentication-bypass bug, CVE-2026-20127, in SD-WAN Catalyst Controllers to deploy the KeyDrift malware framework against aerospace, defense, and policy-research targets, with infrastructure links to Volt Typhoon's Silent Train network.