What happened. On Wednesday Cisco patched CVE-2026-76418 in its Secure Firewall ASA and Firewall Threat Defense (FTD) software, rated 8.6 out of 10. An attacker on the internet sends one crafted request to the SSL remote access VPN and the firewall reloads. No password needed. Cisco says “a successful VPN login is not required to reach the affected processing path.” Cisco’s security team learned in October that it was being exploited. It hasn’t said who is doing it, who’s being hit, or shared indicators of compromise.
The irony is in the trigger. The bug only bites when secondary authentication is configured on a tunnel group. In plain words: a second login check, usually added to make remote access harder to abuse. The safety feature is the attack surface. There’s no true workaround. Cisco’s stopgap is to disable the tunnel group list, or remove secondary authentication altogether, and Cisco itself warns the second option lowers your security. So until you patch, you’re choosing between uptime and a stronger login. That’s a bad trade. Patch instead.
“Just a crash” is the wrong frame. A denial-of-service bug sounds minor next to remote code execution. It isn’t, for this box. The ASA is often the front door for every remote employee and every site-to-site tunnel. When it reboots, the business goes offline. Reboots also clear memory, which is where a lot of short-lived evidence lives. Cisco hasn’t said why attackers want these boxes down. We don’t need the motive to set the rule: an unexplained firewall reload this month is a security event. Pull the crash records, check the timing against your VPN logs, and ask who was connecting.
This is a pattern, not a one-off. It’s the second ASA and FTD crash zero-day exploited since August. CVE-2026-20349, another way to remotely reload the box through the same VPN service, went into CISA’s Known Exploited Vulnerabilities list on Aug. 11. Last September, two ASA zero-days tied to the ArcaneDoor espionage campaign pushed CISA to issue Emergency Directive 25-03, giving federal agencies 24 hours to act. Shadowserver currently tracks more than 51,000 ASA SSL VPN devices exposed online. As of Thursday morning, the new bug wasn’t yet in CISA’s catalog. Don’t wait for it.
And it’s not just Cisco. The same week, Palo Alto Networks confirmed PHP2Shell is being exploited against internet-exposed PAN-OS management interfaces. CISA’s deadline for federal agencies to deal with those PHP flaws is today. Different vendor, different bug, same lesson. The appliance at your edge is reachable by everyone, and its admin and login pages are the most valuable code it runs.
The quiet line in the advisory. Cisco lists what is not affected: its cloud-delivered firewall and its Secure Access service, Cisco’s version of SSE (security service edge, where remote access runs in the vendor’s cloud instead of on your box). That’s the cloud-access pitch in one sentence. When the vendor runs the front door, the vendor patches it, often before you hear about the bug. Cloud services aren’t immune. They have outages and bugs of their own. But they move patching off your weekend change window.
The uncomfortable part for buyers. On Fortinet’s earnings call this week, Ken Xie said AI is discovering more vulnerabilities, “like all the PHP,” and that FortiGate is in the best position to stop those attacks. He may be right that inline signatures help. But notice the loop. Edge-box bugs are now part of the demand story for more edge boxes. Every refresh deserves one hard question: does this box need to face the internet at all?
What I’d do today. Upgrade ASA and FTD to the fixed releases in Cisco’s advisory. Check whether you run secondary authentication on any tunnel group, including DefaultWEBVPNGroup. Review reloads and crash files since Oct. 1. Lock management interfaces, Cisco and Palo Alto alike, to an internal admin network. Then put a date on the bigger question: which remote access still has to live on a box you own?