Cisco Firewall Flaw Is Being Used to Crash VPNs — Patch Now
If your business runs a Cisco ASA or Secure Firewall Threat Defense box with a remote access VPN, check it today. Attackers are already sending it requests that make it reload, and no login is needed.
Cisco published an advisory on 28 October for CVE-2026-76418 (CVSS 8.6) and says it knows the flaw is being exploited in the wild. A crafted request to the SSL VPN login service forces the firewall to restart. It only applies when secondary authentication is set on a tunnel group, including the default one. Cisco has fixed releases for both ASA and FTD, and cloud-delivered Firewall and Secure FMC aren't affected.
| Detail | What it means |
|---|---|
| CVE-2026-76418 | High (8.6) unauthenticated denial of service, exploited in the wild |
| Affected | Cisco Secure Firewall ASA and FTD with SSL VPN and secondary authentication on a tunnel group |
| Fixed in | ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 |
Why this matters for Australian businesses
It's easy to shrug at a "denial of service" because nothing gets stolen. We'd push back on that. For a small business the firewall is the front door: VPN, site-to-site links and often the internet itself all run through one box. A device stuck in a reload loop is an outage, and it lands hardest on single-site offices and regional branches in places like Orange, Bathurst and Dubbo, where there's rarely a second firewall or a failover link to carry the load.
There's also a trap in the workaround. Cisco's stopgap is to remove secondary authentication, which is the extra login step many businesses added after a cyber insurance questionnaire. Dropping it trades an outage risk for a weaker VPN. Patch instead.
What to do about it
- Check what you run. Ask your IT provider whether you have an ASA or FTD firewall with a remote access VPN.
- Upgrade to a fixed release from the table above, and book the outage window now.
- Only use the mitigation as a short stopgap, with a date to patch and a note to restore secondary authentication afterwards.
- Watch for unexplained reloads in your firewall logs over the past few weeks.
Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices, Cyber Security News, 29 October 2026
Frequently Asked Questions
Not sure which firewall your business runs?
If nobody can tell you the model, version and VPN setup of your firewall, let's find out together before the next advisory lands.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →