"This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group," Cisco said in its advisory.
CVE-2026-76418: what Cisco says and the immediate impact
Cisco disclosed a high-severity flaw tracked as CVE-2026-76418 in its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that has been "exploited in the wild." The vulnerability carries a CVSS score of 8.6. According to Cisco, successful exploitation can allow "an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition."
Cisco said it became aware of active exploitation of the vulnerability in October 2026 but did not provide specifics about when the attacks began, who is responsible, or the scale of the exploitation.
Technical cause and the precise conditions that create exposure
Cisco attributes the flaw to logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. The company explains the exploitation path concisely: "An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition."
Cisco lists three specific conditions that must be met for a device to be vulnerable: the device must be running a vulnerable release of Cisco Secure Firewall ASA or Secure FTD Software; the SSL remote access VPN login service must be reachable; and secondary authentication must be configured in the tunnel group scope. Notably, Cisco warns that "A successful VPN login is not required to reach the affected processing path."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhich ASA and FTD releases are fixed — exact versions
Cisco issued fixes across multiple ASA and FTD release lines. Administrators should match their installed release to the corresponding fixed version listed below and plan updates accordingly.
- Cisco Secure Firewall ASA Software Release
- 9.16 and earlier - Fixed in 9.16.4.104
- 9.18 - Fixed in 9.18.4.96
- 9.20 - Fixed in 9.20.4.50
- 9.22 - Fixed in 9.22.3.200
- 9.23 - Fixed in 9.23.1.48
- 9.24 - Fixed in 9.24.1.27 and 9.24.10.1
- Cisco Secure FTD Software Release
- 7.0 and earlier - Fixed in 7.0.11
- 7.2 - Fixed in 7.2.13
- 7.4 - Fixed in 7.4.9
- 7.6 - Fixed in 7.6.7
- 7.7 - Fixed in 7.7.14
- 10.0 - Fixed in 10.0.3
- 10.1 - Fixed in 10.1.1
Configuration checks and Cisco's temporary mitigations
Cisco provided configuration guidance administrators should verify immediately. It instructed customers to examine tunnel groups for secondary authentication settings and included two explicit checks:
- "If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group."
- "If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, check the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication."
As temporary mitigations, Cisco recommended either turning off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disabling secondary authentication on any user-configured tunnel group list or on the DefaultWEBVPNGroup. For Secure FTD Software specifically, Cisco advised administrators to "review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM."
Related activity: UAT-11473 and the KeyDrift framework
The CVE-2026-76418 advisory arrived alongside Cisco disclosures about a separate advanced persistent threat actor. Cisco said an actor tracked as UAT-11473 weaponized CVE-2026-20127, "an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances," to bypass authentication and gain unauthorized access to affected systems. Cisco assessed that UAT-11473's activity targeted space and satellite services, defense and aerospace technology, and policy research sectors, and that it "share[s] infrastructure overlaps with Volt Typhoon's Silent Train covert network."
Cisco Talos described the post-exploitation toolkit: "UAT-11473 then installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts," and added that "The framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."
What network administrators and procurement leaders must do now
Administrators managing ASA or FTD devices should verify whether their systems meet the three exposure conditions Cisco outlined, check tunnel groups (including DefaultWEBVPNGroup) for secondary-authentication-server-group settings, and apply the fixed releases listed above. Where immediate patching is not possible, teams should implement the temporary mitigations Cisco recommended and review remote access VPN policies and device running configurations via Cisco Secure FMC or Secure FDM for FTD deployments.
The record Cisco released is precise about the flaw, the affected configurations, and the fixes — and it is likewise specific about what the company did not disclose: timing, attribution and scale of the active exploitation. Administrators can act on the concrete fixes and configuration guidance now; Cisco's advisory and the related Talos analysis of UAT-11473 and KeyDrift underline that both denial-of-service and more persistent, key-exfiltration threats are active considerations for network security teams.
