Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Summary
Cisco says CVE-2026-76418 is being exploited against ASA/FTD Remote Access SSL VPN; crafted unauthenticated requests can reload devices. Cisco advises checking secondary-authentication settings and offers temporary mitigations.
Key points
- Cisco rates CVE-2026-76418 as high severity (CVSS 8.6) and says it became aware of active exploitation in October 2026; it did not disclose the attackers or scale.
- The flaw stems from logic errors when secondary authentication is configured on an ASA or FTD tunnel group. A crafted request to the SSL remote access VPN could let an unauthenticated remote attacker reload the device and cause denial of service.
- Cisco says exposure depends on tunnel-group-list settings and whether the default or a user-configured tunnel group uses secondary authentication.
- Cisco recommends reviewing the relevant tunnel-group configuration and offers temporary mitigations, including disabling secondary authentication on affected groups.
- Cisco also says UAT-11473 weaponized CVE-2026-20127 to gain unauthorized access to SD-WAN Catalyst Controller instances; the activity targeted space and satellite, defense and aerospace, and policy research sectors.
- Cisco Talos says UAT-11473 used the KeyDrift framework, including PolyFlame and LittleFilch, to collect sensitive keying information and support persistent access and automated exfiltration.
Article Details
- Vulnerability Types
- Denial of service caused by logic errors when secondary authentication is configured on a tunnel group
- Authentication bypass
- Severity
- High (CVSS 8.6)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication.
- Disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup.
MITRE ATT&CK
T1040 · Network SniffingKeyDrift can intercept decrypted SD-WAN control traffic and extract control-session metadata and data-plane keying material.T1041 · Exfiltration Over C2 ChannelKeyDrift is described as automating exfiltration of sensitive keying material and staging or transmitting collected material in encrypted records.T1190 · Exploit Public-Facing ApplicationThe article says attackers exploited flaws in the remote-access SSL VPN and Cisco SD-WAN Catalyst Controller to reach affected systems; UAT-11473 used CVE-2026-20127 to bypass authentication.T1499 · Endpoint Denial of ServiceExploitation of CVE-2026-76418 can cause an affected ASA or FTD device to reload, resulting in denial of service.
CVE
CVE-2026-20127revealed that a sophisticated advanced persistent threat (APT) actor tracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypassCVE-2026-76418The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a
Threat Actors
UAT-11473Cisco disclosed that this tracked APT actor weaponized CVE-2026-20127 to bypass authentication and gain unauthorized access to Cisco SD-WAN Catalyst Controller instances.Volt TyphoonThe article says the activity attributed to UAT-11473 is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network; it does not attribute the activity to Volt Typhoon.
Malware
KeyDrift"UAT-11473 then installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoorsLittleFilchcustom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and intermediatePolyFlameinstalled a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and
Vendors
Products
Cisco SD-WAN Catalyst Controllertracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypass authentication and gain unauthorized access to affected systems.Cisco Secure FDMaccess VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM," Cisco said. "A successful VPN login is not required to reach the affected processing path."Cisco Secure FMC Softwarereview the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM," Cisco said. "A successful VPN login is not required to reach the affectedSecure Firewall Adaptive Security Appliance (ASA) SoftwareCisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in theSecure Firewall Threat Defense (FTD) Softwaresecurity flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
Industries
defense and aerospace technologyThe activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network.Policy researchThe activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network.space and satellite servicesThe activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network.