Cisco Patches Actively Exploited Firewall VPN Flaw

Cisco has released security patches to address a high-severity flaw in its Secure Firewall Adaptive Security Appliance and Threat Defense software. The vulnerability, tracked as CVE-2026-76418, carries a CVSS score of 8.6. It stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured. An unauthenticated remote attacker can exploit this issue by sending a crafted request, causing the device to reload unexpectedly.

Cisco confirmed it became aware of active exploitation in October 2026. The company did not disclose details regarding the start date, the actors involved, or the scale of the attacks. The flaw affects multiple software releases, requiring specific version updates to resolve the issue.

Users must upgrade to fixed versions to mitigate the risk. For ASA software, versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1 contain the fix. For FTD software, versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, and 7.7.14 address the vulnerability.