A security flaw in Cisco's Secure Firewall ASA and FTD software is already being exploited by attackers to crash devices and cut off remote VPN connections, according to the Center for Internet Security.
A newly disclosed vulnerability in Cisco Secure Firewall ASA and Firewall Threat Defense (FTD) software is being actively exploited, according to the Center for Internet Security. These Cisco products are widely used by businesses and government agencies to run firewalls, virtual private networks (VPNs, which create secure remote connections to a network), and other network defenses.
The flaw, tracked as CVE-2026-76418, affects devices where a VPN feature called secondary authentication is turned on for remote-access connections. An attacker does not need a password or account to exploit it. By sending a specially crafted request to a vulnerable VPN service, the attacker can force the firewall to reload unexpectedly, a denial-of-service (DoS) attack that knocks the device offline and interrupts remote access for everyone relying on it.
This matters most for organizations, not individual home users. The Center for Internet Security rates the risk as high for medium and large businesses and government entities, and medium for smaller ones. Home users are considered low risk, since the affected software runs on enterprise network equipment rather than home devices.
Cisco has released software updates that fix the vulnerability across multiple ASA and FTD release lines. According to Cisco, there is no way to fully work around the flaw without updating, though a temporary mitigation is available while patching is arranged.
The Center for Internet Security recommends that affected organizations apply Cisco’s patches as soon as possible after testing them in their own environment, and that they keep network equipment on current, supported software versions going forward.
What you can do: If your business or organization runs Cisco Secure Firewall ASA or FTD software with remote-access VPN, check whether your version is affected and install Cisco’s update promptly.
Based on a release from Center for Internet Security.