Cisco Patches Exploited SSL VPN Flaw in Firewall ASA and FTD Software
Cisco says attackers have been exploiting an unauthenticated denial-of-service bug in the Remote Access SSL VPN service of its Secure Firewall ASA and FTD software. Fixes are out, and no workarounds exist.
Cisco released fixes on Wednesday for a vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that attackers have been exploiting, SecurityWeek reported on October 29, 2026.
The bug sits in the Remote Access SSL VPN service. An unauthenticated attacker can send a malicious request while connecting to the VPN and force the device to restart unexpectedly, disrupting availability. Cisco traces the problem to logic errors in tunnel groups configured with secondary authentication, and notes that a successful VPN login isn't needed to reach the affected code path.
Three conditions have to line up for an attack: an unpatched release, a reachable SSL VPN login service, and secondary authentication in an affected tunnel group. Cisco says its cloud-delivered firewall and management offerings, Secure Access, and the Secure Firewall Management Center aren't vulnerable.
Cisco's product security team learned in October that the flaw was being exploited in the wild. The company hasn't shared details about the attacks or who is behind them. The issue surfaced during a TAC support case, and Cisco credited Eric Fernald with finding it.
No workarounds are available. Customers can lower exposure by disabling the tunnel group list or removing secondary authentication, depending on the default tunnel group's settings, but Cisco warns that dropping secondary authentication weakens remote access VPN security and recommends upgrading instead.
It's the second ASA and FTD zero-day exploited for denial-of-service attacks in recent months. In August, Cisco fixed a separate HTTP request processing flaw that also let unauthenticated attackers trigger a reload through the same service. Cisco didn't disclose details of those attacks either, and it's unclear whether one actor is responsible for both.
For defenders, the practical step is patching. Where that can't happen immediately, check whether the SSL VPN login service is internet-facing and whether affected tunnel groups rely on secondary authentication, then weigh the exposure reduction against the security cost Cisco describes.
CVE references
Sources
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning