A flaw in Cisco firewalls is being used to knock VPNs offline

The news

A serious security flaw has been discovered in Cisco's Secure Firewall ASA and Secure Firewall Threat Defense products. Identified as CVE-2026-76418, this vulnerability allows remote attackers to crash vulnerable firewall devices, disrupting VPN services. The flaw was reported by Cisco's Product Security Incident Response Team (PSIRT) after observing it being actively exploited in the wild. ASA and FTD are the firewalls commonly used by businesses to protect their networks from outside threats.

What it means

This vulnerability can cause your firewall to reload unexpectedly, leading to a denial-of-service (DoS) condition. In practical terms, this means employees might be unable to connect to the company's network remotely, potentially halting work and affecting productivity. Think of it like a guard at your building's entrance being forced to take repeated breaks, leaving the door unattended.

What it means for you

If your business uses Cisco Secure Firewall ASA or FTD products, you need to take immediate action:

  • Ask your IT provider to confirm that the firewall software has been updated this week as per Cisco's latest patches.
  • Check that your company's firewall configurations do not have secondary authentication enabled on any tunnel group.
  • If unable to patch immediately, ask your IT team to disable secondary authentication on vulnerable setups as a temporary solution.
  • Discuss compliance with the US Cybersecurity and Infrastructure Security Agency (CISA) advisory on this matter.
  • If unsure, reach out to a cybersecurity consultant to assess your current setups.

The nerdy bits

  • CVE Number: CVE-2026-76418
  • Affected Products: Cisco Secure Firewall ASA Software, Cisco Secure FTD Software with 'webvpn' configuration and SSL VPN enabled.
  • Technical Cause: Unchecked return value leading to a NULL pointer dereference.
  • Trigger Conditions: Exploited remotely by sending crafted requests to the SSL VPN service.
  • Mitigation: Apply Cisco's software updates, disable secondary authentication on affected groups.
  • CISA Listing: Added to CISA's Known Exploited Vulnerabilities list.

Amine's take

It's crucial to keep your firewall defenses updated and configure them securely. This incident highlights how swiftly attackers can exploit a weakness, emphasizing the need for regular security reviews. Always stay ahead and work closely with your IT teams to patch known vulnerabilities.

Source: BleepingComputer