A security flaw in Cisco's ASA and Firewall Threat Defense software is already being exploited by attackers and can knock out remote access VPN connections, according to the Center for Internet Security.
A newly disclosed security flaw in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense software is already being exploited by attackers, according to the Center for Internet Security. These products are widely used by businesses and government agencies to manage firewalls and virtual private network (VPN) connections, which let remote employees securely access office networks.
The vulnerability, tracked as CVE-2026-76418, affects devices that use SSL remote access VPN with a feature called secondary authentication turned on for a tunnel group, a setting that adds an extra login step for remote users. An attacker does not need a login of their own to exploit the flaw. By sending a specially crafted request to a vulnerable device, they can cause it to crash and restart unexpectedly, cutting off remote access service for everyone relying on it, the Center for Internet Security said.
This matters because many organizations depend on these firewalls to keep remote workers connected securely. A successful attack would not steal data, but it could knock VPN access offline, disrupting business operations until the device recovers.
The Center for Internet Security rates the risk as high for large and medium-sized businesses and government agencies, medium for small businesses and governments, and low for home users.
Cisco has released software updates that fix the issue across several versions of ASA and Firewall Threat Defense software. The company says there is no workaround that fully addresses the problem, though it has made a temporary mitigation available while organizations prepare to update.
What you can do: Organizations using Cisco Secure Firewall ASA or Firewall Threat Defense software should apply Cisco’s security updates as soon as possible after testing, following the recommendations outlined by the Center for Internet Security.
Based on a release from Center for Internet Security.
