Cisco has issued fixes for a high-severity vulnerability in its firewall software that attackers have already exploited in the wild, the networking giant disclosed Wednesday. The flaw, designated CVE-2026-76418 and scored 8.6 out of 10 on the severity scale, lets remote attackers without credentials force affected devices to restart unexpectedly, creating a denial-of-service condition. The company said it discovered active exploitation of the bug this month but didn't reveal when the attacks started, who launched them, or how widespread the campaign has been.
The vulnerability sits within the Remote Access SSL VPN service of Cisco's Secure Firewall ASA and FTD software, affecting devices only when three conditions align: they're running vulnerable software versions, the SSL remote access VPN login can be reached, and secondary authentication is enabled on a tunnel group. According to the advisory, "logic errors when secondary authentication is configured on a tunnel group" create the opening for attackers to send specially crafted requests during SSL remote access VPN connection attempts. The company has released patches across 13 different software versions, spanning ASA releases 9.16 through 9.24 and FTD releases 7.0 through 10.1. Cisco warns that even the default tunnel group, DefaultWEBVPNGroup, exposes systems when secondary authentication is turned on, and turning off the tunnel group list doesn't eliminate the risk if that default group uses the feature.
The company recommends that customers either disable the tunnel group list when DefaultWEBVPNGroup doesn't use secondary authentication, or turn off secondary authentication entirely on user-configured tunnel groups and the default group as a temporary workaround. "A successful VPN login is not required to reach the affected processing path," Cisco noted, meaning attackers don't need valid credentials to trigger the flaw. For FTD deployments, administrators should review remote access VPN policies and the resulting device configuration through Cisco Secure FMC or FDM software to determine exposure.
Separately, Cisco revealed that a sophisticated advanced persistent threat actor designated UAT-11473 weaponized a different authentication bypass bug, CVE-2026-20127, to break into SD-WAN Catalyst Controller systems and deploy custom malware called KeyDrift. The threat group, which shares infrastructure overlaps with the Volt Typhoon espionage operation's Silent Train network, has targeted space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift consists of multiple components—including PolyFlame and LittleFilch—designed to collect sensitive encryption keys, establish backdoors, and serve as intermediate command-and-control hosts, all while operating inside SD-WAN control-plane processes to intercept decrypted traffic and extract keying material for automated exfiltration. The disclosure underscores the parallel risks facing Cisco customers: one from opportunistic attacks exploiting VPN configuration weaknesses, and another from state-aligned groups pursuing persistent access to critical infrastructure through authentication flaws. Organizations relying on perimeter defenses face mounting pressure to accelerate patch cycles while reconsidering architectures that grant broad access based solely on credential checks.