Skip to content
securitytabs

LiveUpdated

Cisco Patches Exploited Firewall VPN Flaw That Can Force Devices to Reload

Attackers are exploiting a flaw in the VPN feature of some Cisco firewalls to make the devices restart, and Cisco has released fixes. Organizations using these firewalls should check for and apply the fixes promptly.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Cisco has released patches for a high-severity flaw in its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild, according to The Hacker News. The flaw is tracked as CVE-2026-76418. [1]

SecurityWeek reports that the flaw is in the Remote Access SSL VPN service and lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. It describes the bug as the second Cisco firewall VPN zero-day (a flaw exploited before a fix existed) exploited since August. [2]

Severity and official listing

The flaw is rated 8.6 on the CVSS scale, according to The Hacker News. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 29, based on evidence of active exploitation. The federal due date is November 1. [1][3]

CISA listed a GitLab flaw, CVE-2026-97229, in the same announcement. [3]

What is not yet known

The available articles do not say who is behind the attacks, how many devices have been affected, or whether detection indicators have been published. [1][2]

Timeline

  1. CISA added the Cisco flaw to its KEV catalogue. [3]

  2. Cisco released patches for the exploited ASA and FTD flaw, The Hacker News reported. [1]

  3. SecurityWeek reported that attackers were exploiting a second Cisco firewall VPN zero-day since August. [2]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run these firewalls directly, but an IT provider may. Exploitation can force a firewall to reload, which would interrupt VPN and network access. [2]

What to do

  1. Ask your IT provider whether it uses Cisco ASA or FTD firewalls and whether Cisco's patches for this flaw have been applied. [1]
  2. Ask the provider whether it has checked its firewalls for unexpected reloads, the effect the sources describe. [2]

Mid-size company

A small IT or security team

What to know

Cisco says the flaw has been exploited, and CISA lists it as exploited, so affected firewalls should be treated as a priority. [1][3]

What to do

  1. Identify Cisco ASA and FTD devices that offer remote access SSL VPN and apply Cisco's patches. [1][2]
  2. Use CISA's November 1 federal due date as a guide to patch timing. [3]

Large enterprise

A security operations team

What to know

The flaw lets unauthenticated remote attackers force firewalls to reload, and is the second exploited Cisco firewall VPN zero-day since August, per SecurityWeek. [2]

What to do

  1. Inventory ASA and FTD firewalls exposing remote access SSL VPN and deploy Cisco's fixed releases. [1]
  2. Review firewall logs for unexpected reloads, which is the effect the sources describe. [2]

Sources

  1. [1]The Hacker News · Oct 29, 10:44 UTC
    Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewallscontext
  2. [2]SecurityWeek · Oct 29, 09:47 UTC
    Attackers Exploit Second Cisco Firewall VPN Zero-Day Since Augustcontext
  3. [3]CISA Advisories · Oct 29, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext