Attackers Are Crashing Cisco Firewalls Through the VPN Sign-In: What to Check on Your Cisco ASA or Firepower

Cisco says attackers are using a new bug to knock its firewalls offline through the VPN sign-in page. The flaw, CVE-2026-76418, sits in the remote access SSL VPN of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD, the software on Firepower and newer Secure Firewall boxes). Cisco published fixes on Oct. 28, 2026 and says it "became aware of active exploitation" this month. On Oct. 29, CISA added the bug to its Known Exploited Vulnerabilities list and gave federal agencies until Nov. 1 to fix it.

This is an outage problem, not a data-theft one: Cisco describes a crash that makes the firewall restart. But when the firewall restarts, everyone behind it loses the internet and every remote worker loses the VPN. For offices that run on one Cisco box, that's the whole business going quiet for a while, and it can happen again as long as the device is unpatched.

What's been reported

No password needed. Cisco's advisory says an unauthenticated, remote attacker can send "a crafted request when connecting to the SSL remote access VPN" and make the device reload. It adds: "A successful VPN login is not required to reach the affected processing path." Cisco rates it High, CVSS 8.6.
Only a certain VPN setup is exposed. A firewall is affected if it runs a vulnerable release, its SSL VPN sign-in is reachable, and secondary authentication (a second sign-in check against another login server) is set on a VPN connection profile, including the hidden default one, DefaultWEBVPNGroup. Cisco says the cause is "logic errors when secondary authentication is configured on a tunnel group."
Exploited, but few details. Cisco hasn't said who is behind the attacks or who was hit, and BleepingComputer notes it shared no indicators of compromise. Cisco hasn't reported any data theft or remote code execution tied to this bug.
Second time since August. SecurityWeek calls it the second ASA and FTD zero-day exploited to crash firewalls in recent months, after CVE-2026-20349 in August. It says it's unclear whether the same attackers are behind both.
Lots of exposed devices. BleepingComputer reports that Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices reachable online. That's a count of exposed devices, not of attacks.
Fixes are out, no true workaround. Cisco's first fixed ASA releases are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 or 9.24.10.1. For FTD they're 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cisco lists a temporary mitigation (turning off the connection-profile list or removing secondary authentication) but warns that removing it weakens VPN security and recommends upgrading. Cisco's cloud-delivered firewall, Secure Access and Firewall Management Center aren't affected.

Why it matters for a small business

Cisco ASA and Firepower boxes are common in offices that grew up with an IT provider: law and accounting firms, engineering firms, manufacturers, and production and exhibit shops whose estimators, designers and show crews connect back to the office over Cisco's VPN client. In those offices the firewall is a single point of failure. A crash in the middle of a deadline, a payroll run or a show load-in means phones, file shares and cloud apps all drop together.

Cisco also says the bug is reached before anyone signs in, so strong passwords and MFA on the VPN don't stop it. Only the update, or Cisco's temporary mitigation, closes it. And with the federal deadline falling on Sunday, a weekend maintenance window is the natural time to do it.

Clear takeaway

If your office uses a Cisco ASA or Firepower firewall for remote VPN, get your IT provider to confirm the running software version and patch it to Cisco's fixed release this weekend; until then, ask whether your VPN uses secondary authentication and whether Cisco's temporary mitigation fits.

What to do this week

Find out what you have. Ask your IT provider whether your firewall is a Cisco ASA, Firepower or Secure Firewall and whether staff use Cisco's VPN client (AnyConnect or Secure Client) to connect from outside.
Get the version in writing. Ask for the exact ASA or FTD version and compare it with Cisco's fixed list above, or run it through the Cisco Software Checker linked in the advisory.
Book the update now. Schedule the upgrade for a quiet window this weekend, with someone on site or able to reach the box if it doesn't come back cleanly. Make sure there's a current saved copy of the firewall configuration first.
Check the risky setting. Ask whether any VPN connection profile, including the default DefaultWEBVPNGroup, has secondary authentication turned on. If it does and the patch can't go in right away, discuss Cisco's temporary mitigation and its security trade-off before changing anything.
Watch for unexplained reboots. Ask your provider to check the firewall's uptime and logs for unexpected reloads since early October and to alert you if one happens.
Plan for the outage you might get. Know who to call if the firewall drops, keep a phone hotspot for critical work, and make sure key staff can reach email and cloud files without the office VPN if it goes down.
Close the other doors too. While someone is on the firewall, confirm its admin page isn't open to the internet and that every VPN account still belongs to a current employee, as we covered in our PHP2Shell firewall checklist.

How Brotherly Technology can help

Brotherly Technology can check your Cisco firewall's version and VPN settings, schedule and run the update outside business hours, set up alerts for unexpected reboots, and build a simple plan so your team keeps working if the firewall ever drops. If you aren't sure what firewall you have or who manages it, call us and we'll find out.