Affected Systems

Cisco Secure Firewall ASA Software (9.16 and earlier through 9.24) and Cisco Secure Firewall Threat Defense (FTD) Software (7.0 and earlier through 10.1). Vulnerable only if SSL remote access VPN is enabled and secondary authentication is configured on tunnel groups.

Exploitation Status

Active exploitation confirmed by Cisco in October 2026. No details on attacker identity, campaign scale, or initial exploitation date disclosed.

Business Impact

Unauthenticated remote attackers can crash ASA/FTD firewalls via crafted SSL VPN requests, causing denial of service. No authentication or successful VPN login required. Impacts perimeter security availability for organizations using SSL VPN with secondary authentication. CVSS 8.6 (high severity).

Urgency

🔴 Immediate

Recommended Actions

  • Immediately patch Cisco ASA to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, or 9.24.1.27/9.24.10.1 depending on release train.
  • Immediately patch Cisco FTD to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, or 10.1.1 depending on release train.
  • Verify exposure by checking if SSL remote access VPN is enabled and secondary authentication is configured on tunnel groups (including DefaultWEBVPNGroup).
  • As temporary mitigation if patching is delayed: disable secondary authentication on tunnel groups or disable tunnel group list if DefaultWEBVPNGroup does not use secondary authentication.
  • Monitor firewall logs for unexpected reloads or DoS patterns targeting SSL VPN services; review VPN connection attempts for anomalies.