No account needed: hackers are knocking out Cisco firewall VPNs by forcing them to reboot
On October 28, Cisco patched CVE-2026-76418, already exploited against ASA and FTD firewalls whose VPN uses dual authentication. Here are the versions to install and the workaround if the update has to wait.
Automated publication. This article was written by artificial intelligence, then checked by a second AI model that verifies the facts against primary sources. It was published without prior human review.
Translated from French by AI. The original French article is the reference version.
The firewall reboots without warning, and the VPN connections of the entire company go down with it. No account is needed to cause this: a specially crafted request sent to the VPN login page is enough. On October 28, Cisco published an advisory on this flaw, CVE-2026-76418, and says attackers are already exploiting it.
It affects Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, with a score of 8.6 out of 10. A remote attacker with no credentials could force the device to reboot, causing a service outage. According to the advisory, the attack cuts the network but does not give access to it.
Which firewalls are affected?
According to Cisco, three conditions must be met: an unpatched version, a reachable SSL VPN login service, and at least one connection profile (“tunnel group”) configured with secondary authentication, meaning a second authentication server. A successful login is not required to trigger the bug.
To check, Cisco advises looking for the webvpn command with enable on an interface, then secondary-authentication-server-group in the profiles, including the default profile DefaultWEBVPNGroup. Not affected: Secure Firewall Management Center, cloud-delivered firewall and management offerings, and Secure Access.
Who is attacking, and since when?
Cisco says it learned of the exploitation in October 2026, without publishing any indicators of compromise or naming an attacker. The flaw was found by Eric Fernald during a Cisco technical support case.
This is the second flaw of this kind in a few months. In August, Cisco had already patched CVE-2026-20349, also exploited to reboot ASA and FTD devices through the SSL VPN, SecurityWeek notes, adding that it does not know whether the same attackers are behind both. The Shadowserver organization tracks more than 51,000 ASA firewalls with an SSL VPN exposed on the internet, according to BleepingComputer. Earlier this month, Cisco already had to patch an exploited flaw in its email gateway.
What to do?
The VPN is the entry point for remote workers: repeated reboots are enough to paralyze a team. Cisco recommends installing a fixed version:
- ASA: 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1;
- FTD: 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
No workaround fixes the flaw. In the meantime, Cisco describes a temporary measure. If the default profile does not use secondary authentication, you can hide the profile list (no tunnel-group-list enable); users must then know the exact name of their profile. Otherwise, secondary authentication must be removed (no secondary-authentication-server-group), which weakens VPN security, the vendor warns.
It remains to be seen who is exploiting these flaws repeatedly, and for what purpose. Cisco is saying nothing about it for now.
Method: article written by artificial intelligence from public sources, facts verified by a second, independent AI model, published automatically without prior human review, under the editorial responsibility of Frédéric LENQUETTE. Spotted an error? Let us know. Our editorial policy.
Share this article
