A high-severity vulnerability affecting Cisco Secure Firewall ASA and FTD is under active exploitation. Tracked as CVE-2026-76418, the flaw poses a significant availability risk to vulnerable, internet-facing devices.
What is the threat?
The primary threat is CVE-2026-76418, a flaw in the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD. When secondary authentication, such as RADIUS, LDAP, or Duo, is enabled on a VPN tunnel group, a remote attacker can send a specially crafted connection request to the public VPN login page without a valid username or password.
Processing the request causes the firewall to reload, disrupting VPN access and other traffic that depends on the device. Attackers can repeat the process to create an ongoing DoS condition.
Devices are vulnerable if they run an affected ASA or FTD version, expose the SSL remote access VPN service, and have secondary authentication configured on any tunnel group, including the default DefaultWEBVPNGroup. A successful VPN login is not required. Cisco has confirmed active exploitation, meaning internet-facing firewalls are already being targeted.
Why is it noteworthy?
This flaw directly targets perimeter firewalls and VPN gateways, which are critical to remote access and network availability. Because exploitation requires no authentication, anyone who can reach a vulnerable SSL VPN login page could repeatedly crash the device.
With real-world exploitation already observed, this is an active threat for organizations that have not patched. Combined with separate SD-WAN authentication bypass activity, it also highlights attackers’ growing focus on Cisco networking and security infrastructure.
What is the exposure or risk?
Organizations are exposed if they run vulnerable ASA or FTD versions, make SSL remote access VPN services reachable from untrusted networks, and use secondary authentication on a tunnel group. An attacker could remotely force the firewall to reload, disrupting VPN access and potentially other traffic handled by the device.
For organizations relying on a single firewall or poorly configured high-availability (HA) pairs, exploitation could cause widespread connectivity loss for remote workers, branch offices, and internet-facing applications. Even with HA in place, repeated crashes could trigger failovers, instability, and degraded performance.
Attackers could also use the DoS as part of a broader campaign to distract defenders or disrupt monitoring while targeting other systems. Organizations with numerous exposed devices, including MSPs and multi-tenant environments supporting multiple customers, may face greater operational risk.
Combined with exploitation of the Cisco SD-WAN authentication bypass, the activity highlights the broader risk of routing, VPN, and control-plane infrastructure becoming targets for sophisticated threat actors.
What are the recommendations?
Barracuda recommends the following steps to reduce exploitation risk and protect critical infrastructure:
- Patch ASA and FTD to fixed versions: Upgrade Cisco Secure Firewall ASA and FTD devices to Cisco-recommended fixed releases. Prioritize internet-facing VPN gateways and firewalls handling production traffic, and schedule updates as soon as possible.
- Verify SSL VPN and secondary authentication configurations: Identify where SSL remote access VPN is enabled and which tunnel groups use
secondary-authentication-server-group. CheckDefaultWEBVPNGroupas well, even if tunnel-group lists are disabled. Remove secondary authentication where it is not required. - Apply interim mitigations if immediate patching is not possible: If
DefaultWEBVPNGroupdoes not use secondary authentication, disable the tunnel-group list. Otherwise, remove secondary authentication from groups that do not require it. Where feasible, restrict access to the SSL VPN login to expected source networks. Treat these measures as temporary until the software can be upgraded. - Harden VPN and SD-WAN exposure: Limit management and VPN interfaces to only necessary exposure. Restrict administrative access, use strong MFA and Conditional Access policies, and patch CVE-2026-20127 on Cisco SD-WAN Catalyst Controllers where applicable.
- Monitor for crashes and abnormal VPN activity: Alert on unexpected device reloads, repeated VPN login attempts from unusual IP addresses, and sudden drops in connectivity. Correlate reload events with spikes in SSL VPN traffic to identify potential exploitation attempts.
- Review high-availability and failover design: Confirm HA pairs are properly configured and test failover behavior under load. Patch both HA peers, since vulnerable code on both devices could allow an attacker to disrupt the active and standby units.
- Strengthen vulnerability and patch management: Prioritize security advisories affecting firewalls, SD-WAN, VPN, and identity infrastructure. Incorporate Cisco advisories into vulnerability management processes and establish clear ownership for reviewing and applying critical updates.
References
For more information, review the following resources:
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.