New Cisco firewall zero-day being actively exploited
A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices.
A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices.
The short version
- The vulnerability, tracked as CVE-2026-76418 and rated 8.6 in severity, is due to logic errors when secondary authentication is configured on a tunnel group, Cisco said in its advisory .
- It could allow a remote, unauthenticated attacker to send a crafted request when connecting to the SSL remote access VPN that results in a device reload and thus denial of service.
- Vulnerable products “If the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface, the configuration is vulnerable,” the advisory said.
What happened
“If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group . Cisco has released fixes in Secure Firewall ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1.
Why it matters
Patched releases for Secure FTD are versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
Summary by Nerd News Network. Read the full article at Network World via the links above and below.