Attackers can reboot Cisco VPN firewalls before anyone logs in. Cisco says it's live.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Wednesday, 28 October, Cisco released fixes for CVE-2026-76418, CVSS 8.6, in the Remote Access SSL VPN of its ASA and FTD firewalls. An unauthenticated attacker can force the device to reload, and Cisco learned in October that the flaw was being exploited. SecurityWeek says it is the second ASA and FTD zero-day used this way since August.
Why it matters
When the VPN box reloads, every remote developer and on-call engineer loses the way in at the same moment. The attack needs only a reachable SSL VPN login and secondary authentication on an affected tunnel group.
What to do
If you run ASA or FTD with remote access VPN and secondary authentication, upgrade to Cisco's fixed release now; Cisco says there is no workaround.
My take
Lior Aharonov
Founder, 7IT Solutions
Downtime is a security incident too. Whoever can reboot your VPN at will decides when your team goes blind.
Sources
| SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.