Ethical Hacking News
Cisco has released patches to address a critical vulnerability in its Secure Firewall software that has been actively exploited in the wild. The vulnerability, CVE-2026-76418, is rated 8.6 on the CVSS scoring system and can cause a denial-of-service condition if exploited. Customers are advised to patch their devices immediately and follow temporary mitigations to prevent further exploitation. This vulnerability is part of a larger threat landscape that highlights the importance of regular software updates and security patches.
A high-severity security flaw (CVE-2026-76418) in Cisco's Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been actively exploited in the wild, rated 8.6 on the CVSS scoring system.Successful exploitation allows an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.The vulnerability affects devices with secondary authentication configured on a tunnel group, and can be exploited by sending a crafted request when connecting to the SSL remote access VPN.Cisco has released patches to address the vulnerability in specific software versions.Customers are advised to turn off the tunnel group list or disable secondary authentication to mitigate the risk.A sophisticated APT actor has been tracked to weaponize CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances.
A high-severity security flaw in Cisco's Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been actively exploited in the wild, according to a recent advisory from Cisco. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system, indicating a critical level of severity. Successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
The issue is rooted in the Remote Access SSL VPN service of ASA and FTD software, specifically in the logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Cisco became aware of active exploitation of this vulnerability in October 2026, but did not share any specifics as to when the attacks began, who is behind them, and the scale of the efforts. The company has since released patches to address the vulnerability, which are available in the following versions:
* Cisco Secure Firewall ASA Software Release 9.16 and earlier - Fixed in 9.16.4.104
* Cisco Secure Firewall ASA Software Release 9.18 - Fixed in 9.18.4.96
* Cisco Secure Firewall ASA Software Release 9.20 - Fixed in 9.20.4.50
* Cisco Secure Firewall ASA Software Release 9.22 - Fixed in 9.22.3.200
* Cisco Secure Firewall ASA Software Release 9.23 - Fixed in 9.23.1.48
* Cisco Secure Firewall ASA Software Release 9.24 - Fixed in 9.24.1.27 and 9.24.10.1
* Cisco Secure FTD Software Release 7.0 and earlier - Fixed in 7.0.11
* Cisco Secure FTD Software Release 7.2 - Fixed in 7.2.13
* Cisco Secure FTD Software Release 7.4 - Fixed in 7.4.9
* Cisco Secure FTD Software Release 7.6 - Fixed in 7.6.7
* Cisco Secure FTD Software Release 7.7 - Fixed in 7.7.14
* Cisco Secure FTD Software Release 10.0 - Fixed in 10.0.3
* Cisco Secure FTD Software Release 10.1 - Fixed in 10.1.1
Cisco also noted that the vulnerability affects Cisco devices if the following conditions are met:
* They are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software.
* The SSL remote access VPN login service is reachable.
* Secondary authentication is configured in the tunnel group scope.
If tunnel-group-list enable is configured, customers should check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group. If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, customers should check the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication.
As a temporary mitigation, the company is recommending that customers turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup.
Additionally, Cisco has revealed that a sophisticated advanced persistent threat (APT) actor tracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypass authentication and gain unauthorized access to affected systems. The activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network.
The framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records.
Related Information:
https://www.ethicalhackingnews.com/articles/Cisco-Patches-Critical-Vulnerability-in-Secure-Firewall-Software-Warns-of-Active-Exploitation-ehn.shtml
https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html
https://cybersecuritynews.com/cisco-secure-firewall-0-day-vulnerability-exploited/
https://nvd.nist.gov/vuln/detail/CVE-2026-76418
https://www.cvedetails.com/cve/CVE-2026-76418/
https://nvd.nist.gov/vuln/detail/CVE-2026-20127
https://www.cvedetails.com/cve/CVE-2026-20127/
Published: Thu Oct 29 08:25:15 2026 by llama3.2 3B Q4_K_M
