Cisco patches an exploited VPN flaw that can crash firewalls before login

Cisco says attackers are exploiting a flaw that can restart its Adaptive Security Appliance (ASA) and Threat Defense firewalls before login. The network equipment maker released fixes on October 28 for the bug, tracked as CVE-2026-76418. Cisco advisory

These products can also provide a virtual private network, or VPN, an encrypted connection between remote employees and company systems. Administrators decide which users may connect and which internal resources they can reach. Cisco’s administration guide describes separate policies for different users and groups. Remote access documentation

Security specialists call the resulting disruption a denial of service: people lose access to a service they are entitled to use. The Internet Engineering Task Force’s guidance explains that such attacks can consume resources or exploit software faults. The practical exposure is an interruption to a network service employees depend on. Denial-of-service definition

Canada’s Cyber Centre repeated Cisco’s exploitation warning in an October 29 alert. Its notice lists affected software branches and the versions that include fixes. Canadian alert

CISA, the U.S. cybersecurity agency, added the flaw to its Known Exploited Vulnerabilities catalog on October 29 and listed November 1 as the action deadline. The entry calls for vendor mitigations under current federal patching rules, or discontinuing the product if mitigations are unavailable. Catalog entry

Its current directive applies to federal civilian executive branch systems, including systems hosted for agencies by outside providers. It makes agencies responsible for tracking affected systems and ensuring that providers meet the requirements. Directive scope CISA’s implementation guidance says agencies determine each asset’s final deadline from its internet exposure and the directive’s timetable. Deadline guidance

SecurityWeek reported on October 29 that Cisco had not disclosed details about the attacks or the people behind them. It also reported that whether the August and October vulnerabilities were exploited by the same actor remained unclear. That leaves companies with an urgent software repair and limited public information about who was attacked and how the flaw was used. SecurityWeek’s reporting

A second login check is part of the affected setup

Affected devices need an unfixed release, a reachable SSL VPN login and secondary authentication on an exposed connection profile. Hiding the profile menu leaves exposure if the default profile uses secondary authentication. Affected configurations

SSL VPN is Cisco’s name for this remote access service. Secondary authentication asks for a second set of login credentials. Connection profiles let an administrator give different users different settings, including authentication and access policies. That explains why the person responsible for a firewall needs to inspect its configuration as well as its software version. How connection policies work

To reduce exposure temporarily, Cisco describes hiding the list when the default profile has no secondary authentication, or removing secondary authentication when it does. Removing it weakens remote access protection. Users can supply a known profile without the list. Cisco recommends upgrading. Mitigation and its tradeoff

October’s releases address a different VPN flaw

Cisco disclosed a different exploited VPN vulnerability, CVE-2026-20349, on August 11. That flaw also allowed an attacker without an account to force a firewall restart, but Cisco attributed it to insufficient checking of web requests. Its advisory was updated on September 16 with release information and a reference to broader security hardening. Earlier advisory and revision history

For ASA 9.20, September’s listed fix was 9.20.4.49 and October’s is 9.20.4.50. For ASA 9.18, those releases are 9.18.4.94 and 9.18.4.96. For Threat Defense 7.6, they are 7.6.6 and 7.6.7. September release table October releases

For Threat Defense, the October notice lists first fixed releases of 7.0.11 for the 7.0 branch and earlier, 7.2.13 for 7.2, 7.4.9 for 7.4, 7.6.7 for 7.6, 7.7.14 for 7.7, 10.0.3 for 10.0 and 10.1.1 for 10.1. Customers need the target for their installed branch and compatible hardware. October Threat Defense releases

Other ASA branches have their own listed fixes: 9.16 and earlier require 9.16.4.104, 9.22 requires 9.22.3.200, and 9.24 lists 9.24.1.27 or 9.24.10.1. The advisory’s release table and hardware compatibility guidance determine the appropriate target. Additional ASA releases

Cisco provides a Software Checker that accepts a product, platform and installed release. Its results distinguish the first version that fixes a particular advisory from the first version that fixes all the advisories identified for that release. Administrators can check other disclosed problems when choosing the target for this update. Software Checker description

The update must fit the device and its remote users

Cisco’s upgrade guide tells administrators to check the path from their current release to the target, including any intermediate versions. It also calls for configuration backups and checks for changes that affect compatibility. Those requirements make this a job for whoever manages the firewall, whether an employee or an outside service provider. Upgrade planning

The guide gives concrete reasons to check before jumping between major versions. It says the virtual ASA cannot be downgraded to an earlier version after moving to 9.24(1), which introduces a new bootloader. A bootloader starts the operating system. It also describes compatibility requirements between firewall software and its graphical administration application. Version-specific limits

Cisco’s guide also flags a service issue for specified ASA releases, including September’s 9.20.4.49. A VPN load-balancing cluster, which spreads connections across devices, does not form while members run different versions. Its alternative upgrade procedure temporarily removes cluster authentication keys. Cisco says those keys protect members against denial-of-service and spoofing attacks; its procedure restores the keys after upgrading. Cluster upgrade guidance

Updates also need a distribution route. Cisco’s security policy says customers with qualifying service contracts should use their usual software channels. The company may offer free updates for high-severity security issues, case by case; eligible customers without a contract use its support center. Those updates do not confer a new software license or additional features. Update entitlement policy

Cisco also ties security investigations and fixes to a product’s support lifecycle. After its last day of support, the company says its security team will accept reports but will no longer analyze, fix or disclose potential vulnerabilities. Its policy directs customers to the product’s end-of-sale bulletin for those dates. Support deadlines

Cisco’s remote access dashboard combines connection information from ASA and several managed Threat Defense device types. It shows active and idle VPN tunnels, identifies the ten devices carrying the most remote access sessions, and reports average session duration and data uploaded or downloaded. Cisco’s instructions place the dashboard under Firewall, then Secure Connections and Remote Access VPN. An employee or outside operator can use those observations when checking that remote users’ connections work after installation. Available connection monitoring

Cisco’s security policy says customers without service contracts can request incident assistance through an exception support case. They should have the device serial number, software release and a detailed description of the concern available. For supported hardware or software, its product security team can make a reasonable effort to validate the concern, collect data and report findings. Detailed analysis of wider effects requires a full-service forensic provider. Incident response scope