Update, Oct. 30: The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog Thursday, giving federal civilian agencies until Nov. 1 to fix it, according to its alert.
Cisco says attackers are exploiting a previously unknown flaw in the remote-access VPN of its Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software to force devices to restart, which cuts off remote workers' connections. Cisco disclosed the flaw and released fixes Wednesday in a security advisory, BleepingComputer reported. It is a zero-day, a flaw attackers used before a fix existed.
What Happened
The flaw, CVE-2026-76418, is a denial-of-service bug: attackers can knock VPN access offline by making the device reload. Cisco attributes it to logic errors when secondary authentication, a second login check, is configured on a tunnel group, a set of VPN connection settings. It carries a severity score of 8.6 out of 10.
An attacker needs no account, and a successful VPN login is not required to reach the vulnerable code, SecurityWeek reported, citing the advisory. Devices are exposed when SSL VPN is enabled and an affected tunnel group uses secondary authentication. SecurityWeek said Cisco's cloud-delivered Secure Access and its Secure Firewall Management Center are not vulnerable.
Cisco's product security team learned of exploitation in October, according to both outlets. Cisco has not described the attacks, the attackers or any indicators of compromise, the traces defenders use to check for intrusions.
Cisco recommends upgrading to fixed software and says no workarounds are available. Depending on how the default tunnel group is set up, administrators who cannot patch right away can reduce exposure by turning off the tunnel group list or removing secondary authentication, but Cisco warns that removing it weakens remote-access security.
Why It Matters
For many organizations, the VPN is the front door for remote staff. A forced restart drops active sessions and blocks access until the device recovers, which can stall operations that depend on remote work.
The exposure is broad. Shadowserver, a nonprofit that scans the internet, tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, BleepingComputer reported. It did not say how many use the vulnerable configuration.
The bug also fits a pattern. SecurityWeek said Cisco patched a different exploited flaw, CVE-2026-20349, in August that also let attackers remotely restart devices through the same VPN service. It is unclear whether the same attackers were behind both. The Primary Wire reported earlier this month that CISA ordered agencies to fix an exploited flaw in Cisco's email gateways.
What to Watch
Federal civilian agencies must fix the flaw by Nov. 1. Watch for any Cisco details on the attackers and for signs that the August and October campaigns are linked.
