Attackers can reboot Cisco firewalls through the VPN login page with one request. Upgrade before Sunday’s deadline

By George Bailey   Published: 10/30/26   5 min read
Cyber News

One crafted request to the VPN login page of a Cisco ASA or Secure Firewall Threat Defense box can make the firewall reload. Cisco says attackers are already doing it. Every reload drops every remote worker and every connection passing through the device.

Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.

CISA added the flaw to its exploited list on Thursday and gave federal agencies until Sunday, November 1. Cisco published fixes on Wednesday, so patched releases exist for every supported train.

A firewall that reboots on command takes the VPN down with it. Cisco has fixes for every train, and attackers are already sending the request.

Cisco says attackers are rebooting firewalls through the VPN login

Cisco’s advisory, first published October 28, describes CVE-2026-76418 in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure FTD software. Logic errors in tunnel groups that use secondary authentication let an unauthenticated remote attacker send a crafted request that makes the device reload. Cisco rates it 8.6 and says its product security team learned in October that it was being exploited in the wild.

Cisco has not said who is behind the attacks, when they started or how many devices were hit. A Cisco TAC support case led to the discovery, and the advisory credits Eric Fernald. CISA put CVE-2026-76418 on the Known Exploited Vulnerabilities list on October 29 with a due date of November 1. Its entry marks forensic triage as not required.

SecurityWeek notes this is the second ASA and FTD zero-day used for denial of service since August. That one, CVE-2026-20349, also triggered a reload through the Remote Access SSL VPN service.

Which Cisco firewalls can be knocked over

Three things must be true at once: the box runs an unpatched release, the SSL VPN login service is reachable, and secondary authentication is set on a tunnel group. Cisco’s wording is that “a successful VPN login is not required to reach the affected processing path,” so a stranger on the internet needs no account.

The check is wider than the login page suggests. If tunnel-group-list enable is on, Cisco says to look at every tunnel group, including ones that do not appear in the list shown to users. If it is off, the default group DefaultWEBVPNGroup still counts when it uses secondary authentication. Cisco’s cloud-delivered firewall, Secure Access and the Secure Firewall Management Center are not affected.

Check the tunnel groups, then upgrade to your release train’s fix

Forward this

For whoever runs our firewall and remote-access VPN: Cisco says attackers are crashing ASA and Secure Firewall devices through the VPN login page, and CISA wants federal agencies patched by November 1. Can we confirm whether our firewalls use SSL VPN with a second login factor, and book the upgrade this week? Please tell me if any device has rebooted on its own since the start of October.

Details

Hunt / verify

Source: CISA KEV addition, October 29; Cisco advisory for CVE-2026-76418

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].