What Happened
Cisco says attackers are exploiting CVE-2026-76418, a CVSS 8.6 flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software, according to The Hacker News. A logic error appears when secondary authentication is set on a tunnel group. An unauthenticated attacker sends a crafted request to the VPN login and forces the device to reload. A successful login is not required.
Cisco learned of exploitation in October 2026. It has not named the attackers, the start date, or the scale. Fixes include ASA 9.18.4.96, 9.20.4.50, 9.22.3.200, and 9.24.1.27, plus FTD 7.2.13, 7.4.9, 7.6.7, and 7.7.14.
Why This Matters for Canadian Organizations
Canadian banks, hospitals, universities, municipalities, and government departments rely on ASA and FTD for remote access. Each forced reload drops every VPN session and takes the firewall out of service while it restarts. An attacker repeating the request keeps staff offline and the perimeter unstable.
This is an availability attack on an edge device. Regulated institutions face OSFI B-13 expectations for operational resilience. Any organization holding personal information also owes PIPEDA safeguards, and a firewall in a reload loop weakens both. Our TechTalk coverage of recent edge device flaws shows attackers return to VPN gateways again and again.
What to Do
Upgrade to a fixed release first. If patching waits, disable secondary authentication on every user-configured tunnel group and on DefaultWEBVPNGroup. Disabling the tunnel group list does not remove exposure when DefaultWEBVPNGroup uses secondary authentication. On FTD, review the deployed remote access VPN policy and running configuration in FMC or FDM. Watch for unexplained reloads and crash files, and check our latest news coverage for related advisories.
