Cisco — Cisco Patches Actively Exploited ASA, FTD, and SD-WAN Flaws Targeted by APTs (CVE-2026-76418)

Publication date: October 29, 2026
Category: Vulnerability / Network Security

Introduction

Cisco has issued urgent security updates to address multiple critical and high-severity vulnerabilities currently under active exploitation in production environments. Among the findings is a denial-of-service (DoS) flaw affecting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software, tracked as CVE-2026-76418, which triggers unexpected device reloads. Simultaneously, active exploitation of an authentication bypass vulnerability in SD-WAN controllers (CVE-2026-20127) has been disclosed, linked to an advanced persistent threat (APT) actor tracked as UAT-11473 targeting aerospace, defense, and satellite communication sectors.

What is CVE-2026-76418 and CVE-2026-20127? (General Analysis)

The reported vulnerabilities target core components of Cisco’s perimeter security and enterprise networking architecture:

  • CVE-2026-76418: Resides in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. It stems from logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can exploit this by sending crafted requests to cause unexpected device reboots.
    • Official CVSS (v3.1): 8.6 (HIGH) — Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (Confirmed NVD data).
    • Official CWE Classification: CWE-690: Unchecked Return Value to NULL Pointer Dereference (Confirmed NVD data).
    • CISA KEV Catalog: Yes, listed in the Known Exploited Vulnerabilities catalog.
  • CVE-2026-20127: Affects peering authentication in Cisco Catalyst SD-WAN Controller, Manager, and Validator. It allows an unauthenticated remote attacker to bypass authentication mechanisms and gain internal high-privileged administrative access to manipulate network configurations.
    • Official CVSS (v3.1): 10.0 (CRITICAL) — Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Confirmed NVD data).
    • Official CWE Classification: CWE-287: Improper Authentication (Confirmed NVD data).
    • CISA KEV Catalog: Yes.

How Does It Work? (Technical Analysis)

An examination of both flaws reveals attack vectors designed to compromise perimeter service availability and control plane integrity:

  • Attack Flow for CVE-2026-76418:
    • The SSL VPN service handles incoming remote user connections. When secondary authentication is enabled within a tunnel group scope (specifically on custom groups or the default DefaultWEBVPNGroup), internal validation logic improperly processes connection parameters.
    • No authenticated session or valid credentials are required to reach the affected processing path.
    • Upon receiving a crafted connection request, the firewall subsystem encounters a critical software exception that forces the operating system kernel to abruptly restart the device, resulting in a denial-of-service (DoS) condition.
  • Exploitation Flow for CVE-2026-20127:
    • Threat actor UAT-11473 weaponizes peering authentication flaws in SD-WAN controllers to inject themselves into control plane processes.
    • Once inside, the attacker deploys a custom malware framework tracked as KeyDrift (featuring components like PolyFlame and LittleFilch).
    • KeyDrift operates by intercepting decrypted control traffic, extracting session metadata and data-plane keying material to ensure long-term persistence and automated data exfiltration.

Affected Systems / Environments

Organizations operating Cisco ASA/FTD perimeter security solutions and Catalyst SD-WAN fabrics face immediate operational risks if updates are omitted.

CVE CWE Category Impact CVSS Vector (summary)
CVE-2026-76418 CWE-690 Denial of Service (DoS / Device Reload) 8.6 (HIGH) AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVE-2026-20127 CWE-287 Authentication Bypass / Admin Control 10.0 (CRITICAL) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Cisco ASA Software Versions:

  • Releases 9.16 and earlier (Fixed in 9.16.4.104)
  • Release 9.18 (Fixed in 9.18.4.96)
  • Release 9.20 (Fixed in 9.20.4.50)
  • Release 9.22 (Fixed in 9.22.3.200)
  • Release 9.23 (Fixed in 9.23.1.48)
  • Release 9.24 (Fixed in 9.24.1.27 and 9.24.10.1)

Affected Cisco FTD Software Versions:

  • Releases 7.0 and earlier (Fixed in 7.0.11)
  • Releases 7.2 (7.2.13), 7.4 (7.4.9), 7.6 (7.6.7), 7.7 (7.7.14), 10.0 (10.0.3), and 10.1 (10.1.1).

Mitigation and Detection

Remediation

  1. Software Upgrades: Immediately apply the patched firmware versions released by Cisco in their official security advisories.
  2. Temporary Mitigations for ASA/FTD:
    • Disable secondary authentication on user-configured tunnel groups or on the default DefaultWEBVPNGroup.
    • Review deployed remote access VPN policies via Cisco Secure FMC or FDM to ensure exposure is mitigated.

Detection

Defensive teams must actively monitor system logs for unexpected ASA/FTD reboots and inspect network traffic for anomalies within SD-WAN control services.

“Exploitation of CVE-2026-76418 does not require prior credentials or successful authentication; a remote attacker can trigger a firewall reload via carefully crafted SSL VPN connection requests.”

  • Syslog / CLI Monitoring: Inspect kernel crash logs (Crashinfo) for traces linked to memory allocation failures or exceptions within VPN management processes (vpn-sessionmgr).
  • Indicators of Compromise (IoCs): Audit SD-WAN controllers for unauthorized access to NETCONF interfaces and the presence of KeyDrift malware framework artifacts.

Wrapping Up

The concurrent active exploitation of critical flaws in perimeter VPN gateways (CVE-2026-76418) and modern networking controllers (CVE-2026-20127) highlights the aggressiveness with which state-sponsored actors and APT groups target enterprise infrastructure. Rapid patch deployment and rigorous authentication configuration reviews remain mandatory to ensure operational resilience.

References