Cisco has fixed a zero-day flaw in the remote access virtual private network (VPN) service of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, and attackers are already using it to knock firewalls offline. A zero-day is a flaw that attackers use before the vendor has a fix.
What Cisco published. On 28 October 2026, Cisco released a security advisory for CVE-2026-76418, rated 8.6 out of 10 on the Common Vulnerability Scoring System (CVSS). An attacker on the internet, with no username or password, can send a crafted request while connecting to the Secure Sockets Layer virtual private network (SSL VPN) and force the firewall to reload. That is a denial of service (DoS): the firewall restarts, and everything passing through it stops until it comes back. Cisco says a successful VPN login is not needed to reach the flawed code. Cisco's product security team learned in October 2026 that the flaw was being exploited in the wild. Cisco has not said who is behind the attacks or who was targeted.
Who is exposed. According to Cisco, a firewall is affected only when three things are true. It runs a release without the fix, its SSL VPN login service is reachable, and secondary authentication is turned on in a tunnel group, which is the connection profile a VPN user connects with. Secondary authentication is a second login check, often used for a one-time code. Cisco notes that the default tunnel group counts even when it is not shown on the login page. Cisco's Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center (FMC) software are not affected. BleepingComputer reports that the Shadowserver Foundation tracks more than 51,000 Cisco ASA SSL VPN devices exposed online.
Fixed releases. Cisco lists these first fixed releases. For ASA software: 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. For FTD software: 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. There are no workarounds. Cisco describes a temporary mitigation: turn off the tunnel group list if the default tunnel group does not use secondary authentication, or remove secondary authentication. Cisco warns that removing secondary authentication weakens remote access security, and it recommends upgrading instead.
The second one since August. In August 2026, Cisco fixed CVE-2026-20349, another flaw in the same SSL VPN service that let attackers force a reload without logging in. The Cybersecurity and Infrastructure Security Agency (CISA) added that flaw to its Known Exploited Vulnerabilities (KEV) catalog on 11 August. As of CISA's 28 October catalog release, CVE-2026-76418 had not been added yet. Cisco has not said whether the same attackers are behind both.
Where this shows up from the plant floor to the cloud. ASA and FTD firewalls are common at the boundary between business networks and control system networks, also called operational technology (OT). They are often the VPN that operators, engineers and vendors use to reach plants, pipelines, water sites and remote stations. Cisco's software checker for this advisory also lists the 3000 Series Industrial Security Appliance (ISA 3000), the rugged ASA model used on plant floors and in substations. At a remote pump station or compressor site, the same firewall may also carry the tunnel back to the control center. A forced reload drops every remote session and can drop that tunnel. If the attacker repeats it, the site stays cut off. Local controls should keep running, but monitoring, remote support and anyone working from outside lose their view until the firewall is back.
What it means for OT owners. This flaw does not let an attacker in. It lets an attacker cut you off, on demand, from anywhere on the internet. If your plant depends on that VPN for after-hours support or for links back to the control center, plan as if it can go down at the worst time.
What the Red Tiger team recommends:
With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners review edge firewalls and remote access paths into OT with plant-safe methods, and sets up 24x7 monitoring that can spot unexpected firewall restarts.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources:
Cisco, "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability," cisco-sa-asaftd-tunnel-dos-s6mgkb75, 28 October 2026: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
Cisco, CVE-2026-20349 advisory, cisco-sa-asaftd-vpn-dos-dzv4mQFF, 11 August 2026: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
SecurityWeek, Eduard Kovacs, 29 October 2026: https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/
BleepingComputer, "New Cisco firewall zero-day exploited to crash SSL VPN devices," 29 October 2026: https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Check out our resources and book a follow-up call with our team.
